Ethereum co-founder Vitalik Buterin has now recovered his T-Mobile account after confirming he was a victim of a SIM swap attack that led to a phishing scam on X (formerly Twitter).

“Finally got back my T-mobile account (yes, it was a sim swap, meaning that someone socially-engineered T-mobile itself to take over my phone number),” Buterin wrote on Warpcast — a client for the decentralized social protocol Farcaster, where account recovery can be managed via an Ethereum address.

Despite warnings on the insecure nature of phone numbers for authentication in the crypto space, given the prevalence of SIM swap attacks, Buterin didn’t realize a phone number was sufficient for malicious actors to reset his X account, even if it’s not used for two-factor authentication.

“A phone number is …