"Surely a username/password was also required?"
Yes. From the article:
"From there, the thieves used the cell number to reset the password on Tapang's online cryptocurrency account – which was linked to that number – and then take over its wallets and drain his funds."
Biting the hand that feeds IT
