Friend​.tech’s SIM-Swap Incident Response

After reports of SIM-swap attacks surfaced, the decentralized social network Friend.tech took to social media to announce an updated feature that will enable users to add and remove various login methods used to access their accounts.

On October 4, Friend.tech announced that the settings are now accessible via the app, requiring users to tap their wallet balance to make adjustments.

Users had inquired as to why the platform had not yet enabled a two-factor authentication passcode feature, the platform explained.

According to Friend.tech, the feature in its present state would likely cause users to lock themselves out of their accounts.

It stated that it had proposed UX enhancements to Privy, the company it employs, to facilitate privacy features.

Some Friend.tech users complained in an Oct. 2 Q&A that they were not prompted to validate their passcodes and that neither Privy nor Friend.tech could reset them if they were mistyped.

In the meantime, users have responded to the update, with many claiming their accounts were already closed.

“Privy is working diligently to implement this and we will integrate the feature when they have finished.”

One user complained that, despite removing the number and replacing it with an alternative form of authentication, it did not close out sessions on other devices, allowing hackers to remain logged in.

The platform encountered exploits on October 4, during which users reported that their accounts had been compromised after hackers seized control of their mobile numbers using a SIM swap attack.

As a result, over 100 Ethers were reportedly depleted in less than a week. By October 5, the perpetrators of the compromises had amassed at least $385,000 worth of Ether through their exploits.

All of this is a result of Friend.tech’s significant revenue increases, with surges comprising 10,663 ETH and its total locked value exceeding 30,000 ETH.