A 25-year-old Alabama man has been arrested by the FBI and charged with conspiracy to commit aggravated identity theft and access device fraud in connection with the hack of the Securities and Exchange Commission’s X account earlier this year. The hack resulted in a rogue tweet that falsely claimed bitcoin ETFs had been approved by the regulator, causing a temporary surge in bitcoin prices.
According to the indictment, Eric Council Jr. allegedly worked with co-conspirators to carry out the exploit, which involved a SIM swap attack. Council coordinated with the other individuals over SMS and encrypted messaging apps, and they sent him the personal information of someone with access to the SEC X account, identified only as “C.L.”
Council then used the stolen information to print a fake ID and buy a new SIM and iPhone, allowing him to gain access to the SEC’s X account. He then worked with the other individuals to change the account settings and send the rogue tweet, which was posted on July 6, one day before the SEC’s actual approval of 11 spot bitcoin ETFs.
The tweet caused a significant spike in bitcoin prices, with prices temporarily rising by over $1,000. The incident also raised questions about the security measures in place to protect the high-profile account. The SEC’s Inspector General, Jeffrey, said in a statement that the arrest “demonstrates our commitment to holding bad actors accountable for undermining the integrity of the financial markets.”
The indictment also reveals that Council allegedly conducted some suspicious searches on his personal computer, including queries about hacking, identity theft, and law enforcement investigations. These searches include questions about how to delete a Telegram account, signs of FBI investigation, and federal identity theft statutes.
The FBI’s investigation into the hack has shed new light on the alleged methods used by Council and his co-conspirators to carry out the exploit. The incident has also highlighted concerns about the security of high-profile social media accounts and the need for robust authentication measures to prevent similar attacks in the future.
The SEC’s X account was previously compromised via a SIM swap attack, but the indictment provides new details about how the exploit was allegedly carried out. The FBI’s investigation is ongoing, and Council’s arrest marks a significant step in holding those responsible accountable for the hack.
