Alabama Man Gets 14 Months for Hacking SEC’s X Account

An Alabama man has been sentenced to 14 months in jail for his part in 2024’s hack of the Securities and Exchange Commission’s (SEC) Twitter account, which increased the value of Bitcoin by $2,000.

The man and his co-conspirators used their ill-gotten access to post that Bitcoin ETFs (Exchange-Traded Funds)—a type of investment vehicle long awaited by the crypto community—had been approved days before this happened. This caused the digital currency to spike in value, giving the man and his associates a chance to enrich themselves with trades.

This Tweet is currently unavailable. It might be loading or has been removed.

Eric Council Jr., 26, of Athens, Alabama, used what’s known as a “SIM swap” attack to access the account of an SEC employee in charge of the organization’s social media.

SIM swaps are where bad actors trick a mobile carrier into reassigning a mobile phone number from a victim’s SIM card to the criminal’s own SIM card, allowing them to bypass safeguards like two-factor authentication—potentially giving them access to victims’ social media, bank accounts, or work systems. These are some of the world’s most consistently persistent and widespread types of cyberattacks, targeting many normal people as well as influential organizations like the SEC.

Mr. Council allegedly used a portable ID card printer to create a physical ID, which he then used to impersonate the victim at an AT&T store in Huntsville, Alabama. The man then inserted the SIM card linked to the victim’s phone and activated a brand new iPhone, which he used to get his hands on the @SECGov X password reset codes, before sharing them with his co-conspirators.

Police later tracked the man down, finding numerous suspicious searches on his personal devices, including “What are the signs that you are under investigation by law enforcement or the FBI even if you have not been contacted by them” as well as “SECGOV hack.” He is thought to have received around $50,000 for his role in the scheme.

Though the SEC hack was notable for its sheer ambition, it’s unlikely this is the last major hacked social media account we will see spreading crypto fake news. Numerous celebrity social media accounts have been hacked for this purpose, though mainly to promote smaller currencies known as “memecoins,” including rapper 50 Cent, former President Barack Obama, and Tesla CEO Elon Musk.

About Will McCurdy

Contributor

I’m a reporter covering weekend news. Before joining PCMag in 2024, I picked up bylines in BBC News, The Guardian, The Times of London, The Daily Beast, Vice, Slate, Fast Company, The Evening Standard, The i, TechRadar, and Decrypt Media.

I’ve been a PC gamer since you had to install games from multiple CD-ROMs by hand. As a reporter, I’m passionate about the intersection of tech and human lives. I’ve covered everything from crypto scandals to the art world, as well as conspiracy theories, UK politics, and Russia and foreign affairs.

Read Will’s full bio

Read the latest from Will McCurdy