A 25-year-old Alabama man has pleaded guilty to charges related to the January 2024 hack of the U.S. Securities and Exchange Commission’s social media account on X, which temporarily impacted cryptocurrency markets. The incident represents one of the highest-profile examples of a SIM swap attack, a growing threat that caused over $48 million in losses during 2023.
Eric Council Jr. entered his guilty plea to identity theft charges in U.S. District Court in Washington on February 10, 2025. According to court documents, Council executed a SIM swap attack by using a fraudulent ID to impersonate an individual with access to the SEC’s X account, convincing a mobile phone store to provide him with a SIM card linked to that person’s phone number. The attack method has become increasingly sophisticated, with criminals exploiting weaknesses in mobile carrier authentication protocols.
The compromise enabled unauthorized access to the SEC’s @SECGov account, resulting in a false post claiming the agency had approved Bitcoin spot ETF trading. The post included what appeared to be a quote from SEC Chair Gary Gensler announcing approval for Bitcoin ETFs on all registered national securities exchanges.
A technical investigation revealed that the SEC’s account had disabled multi-factor authentication for six months prior to the incident at the agency’s request. After gaining control of the associated phone number, the perpetrators were able to reset the account password and authenticate through SMS verification – a security measure that cybersecurity experts have increasingly warned against due to its vulnerability to SIM swap attacks.
The unauthorized announcement caused Bitcoin prices to surge briefly to $48,000 before falling back after the SEC confirmed the compromise. The incident highlighted the growing concerns around digital identity fraud and its potential to manipulate financial markets. Prosecutors stated that Council received approximately $50,000 worth of Bitcoin as payment from co-conspirators for his role in the scheme.
Council faces a maximum sentence of five years in prison. His sentencing is scheduled for May 16, 2025. The incident occurred just one day before the SEC officially approved Bitcoin spot ETFs, demonstrating the critical importance of robust authentication measures for high-profile institutional social media accounts.
Sources: Silicon UK, FBI, LA-Cyber.com
Follow Us