Eric Council Jr., a 26-year-old man from Huntsville, Alabama, was sentenced on May 16, 2025, to 14 months in federal prison followed by three years of supervised release for his role in the high-profile hacking of the U.S. Securities and Exchange Commission’s (SEC) official social media account on X (formerly Twitter).

The cyberattack, which occurred in January 2024, involved a sophisticated SIM swap attack that allowed Council and his co-conspirators to post a fraudulent announcement falsely claiming the SEC had approved Bitcoin (BTC) Exchange Traded Funds (ETFs), causing a temporary spike in Bitcoin’s price by over $1,000 before it plummeted by more than $2,000.

Council pleaded guilty in February 2025 to conspiracy to commit aggravated identity theft and access device fraud.

The investigation revealed that Council used personally identifiable information (PII) obtained from co-conspirators to create a fake identification card using a portable ID card printer.

Hijacked the SEC’s X Account

This counterfeit ID was used to impersonate an SEC employee, referred to as “C.L.” in court documents, who had authorized access to the SEC’s X account.

With the fake ID, Council convinced an AT&T employee in Huntsville to perform a SIM swap, an advanced form of identity theft where a victim’s phone number is fraudulently transferred to a SIM card controlled by the attacker.

This enabled the Council to intercept two-factor authentication (2FA) codes sent to the victim’s phone number, including password reset codes for the SEC’s X account.

Once the conspirators gained control of the SEC’s official X account, they posted a message in the name of the SEC Chairman falsely announcing that the SEC had granted approval for Bitcoin ETFs.

This announcement triggered a rapid surge in Bitcoin’s market price, which was later corrected after the SEC regained control and clarified that the post was fraudulent.

Council was charged with conspiracy to commit aggravated identity theft under federal statutes, which involves the unauthorized use of another person’s personal identifying information to commit fraud, and access device fraud, which pertains to unauthorized use of devices or credentials to obtain property or services.

He was arrested in October 2024 following an FBI investigation and subsequently accepted a plea deal.

In addition to the prison sentence, Council was ordered to forfeit $50,000, believed to be payment he received in Bitcoin for facilitating the SIM swap attack.

The Department of Justice emphasized the severity of the crime, highlighting that such cyberattacks threaten the integrity of financial markets and public trust.

Matthew R. Galeotti, head of the Justice Department’s Criminal Division, stated that prosecuting individuals who exploit digital assets through fraud is critical to protecting U.S. interests.

U.S. Attorney Jeanine Pirro underscored the broader threat posed by SIM swap schemes, which endanger the financial security of individuals, institutions, and government agencies alike, warning that perpetrators will be caught and prosecuted.

The fraudulent tweet caused immediate market disruption, with Bitcoin’s price rising sharply before crashing once the SEC clarified the hack.

Although the SEC announced the official approval of 11 spot Bitcoin ETFs less than 24 hours later, the incident exposed vulnerabilities in cybersecurity protocols at a top U.S. financial regulator.

During a search of Council’s residence in Athens, Alabama, FBI agents recovered the fake ID printer, additional fake ID templates, a laptop with incriminating searches related to the hack, and other evidence confirming his involvement.

Preventing SIM Swap Attacks

This case highlights the growing threat of SIM swap attacks, which exploit weaknesses in mobile carrier security processes. These attacks enable criminals to bypass SMS-based two-factor authentication and gain unauthorized access to sensitive accounts, including social media and cryptocurrency wallets.

Security experts recommend measures to mitigate the risk of SIM swapping, such as setting up account PINs with carriers, using authenticator apps instead of SMS for 2FA, keeping personal information private, and monitoring for unusual account activity.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar

The post Hacker Charged for Hijacking SEC Account to Promote Fake Bitcoin News appeared first on Cyber Security News.