An Alabama resident has pleaded guilty to orchestrating an attack on the U.S. Securities and Exchange Commission (SEC) account on the social media platform X.
In January, 25-year-old Eric Council Jr. breached the SEC’s account and published a fraudulent statement falsely claiming the imminent approval of cryptocurrency exchange-traded funds (ETFs). The deceptive announcement triggered a sharp surge in Bitcoin’s value, driving it up by $1,000 before the price plummeted by $2,000 shortly after the SEC chairman confirmed that the account had been compromised and the statement was a hoax.
The following day, the SEC officially confirmed that the breach occurred due to the hijacking of the account administrator’s phone number. Council reset the password and granted access to his accomplices, who paid him $50,000 in Bitcoin for the opportunity to post the misleading announcement.
Council Jr. and his co-conspirators gained control of the regulator’s account using a SIM-swapping scheme. The attackers forged documents to impersonate the legitimate owner of the phone number linked to the SEC account. Armed with a counterfeit ID, Council visited an AT&T store, where he obtained a new SIM card assigned to the victim’s number. He then purchased a new iPhone, activated the hijacked number, and used it to intercept two-factor authentication codes for the SEC account.
Court records further reveal that following the attack, Council searched Google for information on hacking the SEC, methods to delete a Telegram account, and signs of potential FBI surveillance. He also attempted to determine whether an investigation had been launched against him.
A spokesperson for X stated that the SEC account’s compromise was not the result of a platform vulnerability but rather the actions of third parties who gained control of the phone number linked to the account. However, the indictment notes that two-factor authentication was enabled at the time of the breach, contradicting the social media company’s official statement.
Council now faces up to five years in prison for conspiracy to commit fraud and identity theft. His final sentencing is scheduled for May 16, 2025.
