SEC Hacker Jailed 14 Months for SIM-Swap Bitcoin ETF Scam

Eric D. Council, a resident of Athens, Alabama, has been sentenced to 14 months in prison for orchestrating a SIM-swap attack that compromised the official X (formerly Twitter) account of the U.S. Securities and Exchange Commission (SEC). The cyberattack, which took place in January 2024, falsely announced the approval of Bitcoin ETFs, triggering a brief surge in Bitcoin’s price of over $1,000 before quickly reversing once the hoax was exposed.

Council executed the hack by obtaining the personal information of an SEC account manager and using it to forge a fake ID. He then used this identity to persuade a mobile store employee to issue a replacement SIM card, successfully bypassing two-factor authentication (2FA) on the SEC's X account. Once he had control of the account, he posted the misleading ETF approval tweet, manipulating the market and benefiting from the resulting volatility.

Authorities confirmed that Council was not acting alone and received $50,000 for his role in the sophisticated crypto fraud scheme. He pleaded guilty to wire fraud and related charges in April 2025.

SIM-swapping attacks, where hackers hijack mobile numbers to access sensitive accounts, remain a growing threat in the crypto space. This case follows other high-profile incidents, including the 2020 Twitter hack by Joseph James O’Connor, which targeted accounts of celebrities like Elon Musk and Kim Kardashian to promote a fake Bitcoin giveaway. Another infamous case involved investor Michael Terpin, who lost $24 million in crypto and sued AT&T for failing to prevent the SIM-swap.

This latest sentencing highlights the ongoing risks of inadequate digital security and the high stakes of cryptocurrency-related cybercrime. Investors and institutions are urged to strengthen 2FA protocols and remain vigilant against social engineering tactics.