- Eric Council Jr. was sentenced to 14 months in prison for hacking the SEC’s X account.
- He used a SIM swap attack to gain access to the SEC’s mobile number.
An Alabama man, Eric Council Jr., has been sentenced to 14 months in prison for his role in the January 2024 hack of the SEC’s official X account. The hack led to a false post claiming the SEC had approved spot Bitcoin ETFs, causing rapid market fluctuations.
Council, 26, from Athens, Alabama, conspired with others to perform a SIM swap attack on a phone number linked to the SEC’s @SECGov account. On January 9, he used a fake ID at an AT&T store to obtain a SIM card tied to the account. He then activated it on a new iPhone and received password reset codes for the SEC’s X profile.
Inside the SEC X Hack
Council captured and shared the codes with co-conspirators. One of them used the reset credentials to access the account and post the false Bitcoin ETF approval. Bitcoin’s price soared by over $1,000 within minutes but dropped more than $2,000 after the SEC denied the claim.
Although Council did not write the fake post, prosecutors said he played a crucial role in enabling the scheme. He pleaded guilty in February to conspiracy to commit aggravated identity theft. Authorities arrested him in October 2024.
Investigators found he had also attempted other SIM swaps and identity frauds. In June, agents searching his apartment found a fake ID, a portable ID printer, and a laptop with forged document templates. His internet history included searches such as “SECGOV hack” and “signs the FBI is after you.”
Council also appeared in a video circulated by a hacker group in February. In it, he acknowledged his role, blamed SEC cybersecurity failures, and downplayed his responsibility. Prosecutors included the video in their sentencing memo. However, his lawyer argued for leniency, citing no criminal history and mental health struggles linked to marijuana use.
Judge Amy Berman Jackson imposed the 14-month sentence, 10 months less than what prosecutors sought. Additionally, Council must forfeit $50,000, the amount he earned from the SIM swaps, and serve three years of supervised release.
During the breach, the SEC’s poor cybersecurity was also exposed. A prior report found its systems “not effective” and in need of improvement. Ironically, the SEC officially approved Bitcoin ETFs just one day after the fake post.
Highlighted Crypto News Today
Galaxy Digital’s Nasdaq Listing Sets Stage for Stock Tokenization Push
