According to ZachXBT, Vitalik Buterin is a “big enough target” that an X employee could have been paid off to perpetrate the hack.

Ethereum co-founder Vitalik Buterin’s account on X (formerly Twitter) was compromised late at night on Sept. 9. Dmitriy Buterin, father of Vitalik, confirmed the hack through his X account.

Vitalik’s hacked account was used to promote a fishing link that stole crypto and non-fungible tokens (NFTs) from wallets that interacted with it. According to on-chain sleuth ZachXBT, the hacker has drained around $691,000 of assets from victims.

The phishing post, which has since been deleted, lured victims by claiming to celebrate “Proto-Danksharding coming to Ethereum.“ The hacker posted a malicious link to mint a fake free commemorative NFT. The fake NFT mint had a 24-hour time limit, urging victims to act quickly.

A CryptoPunk NFT worth 153 ETH or approximately $250,000, owned by Ethereum developer Bok Khoo, was among the assets stolen in the attack. The attacker has sold most of the NFTs while much of the proceeds are still in the hacker’s wallet.

A user on X claimed that Vitalik’s negligence led to the attack. Therefore, the Ethereum founder “should take accountability” and “compensate those affected,” the user stated, adding:

“@vitalikbuterin you have more than enough personal wealth to make affected users whole. If the founder of any other tradfi platform posted links that resulted in fraud, that platform would be obligated to do the same, or risk facing a class action lawsuit.”

The user further claimed that the hack of Vitalik’s account was probably perpetrated through a SIM swap. In SIM swaps, attackers gain control of the victim’s phone number by convincing the victim’s mobile carrier to transfer the phone number to a new SIM card.

ZachXBT, however, noted that the assumption may not hold ground. He stated:

“you do not know yet whether it was a SIM swap. Vitalik is a big enough target to where an insider could have been paid off or panel was used.”