Hacker behind SEC’s fake bitcoin ETF post pleads guilty #NewsETFs

The man behind a fraudulent post last year about bitcoin exchange traded funds (ETFs), from the official X account of the Securities and Exchange Commission (SEC), pleaded guilty this week to an identity theft scheme that enabled him to access the SEC’s X account.

Eric Council, Jr., who lives in Athens, Alabama, agreed to spend 24 months in prison for conspiracy to commit identity theft after he posed as an FBI agent at an AT&T store to obtain a SIM card for an identity theft victim identified in the unsealed indictment as C.L. That victim had access to the SEC’s official X account, which Council used to falsely post that the SEC had approved bitcoin ETFs.

It is unclear whether C.L. is an FBI agent. The indictment indicates that Council impersonated an FBI agent to obtain a SIM card for C.L.’s account, but it does not indicate whether Council impersonated C.L.

Council identified C.L. as the target for the identity theft scheme after receiving personal information about the person from other co-conspirators, who also told Council to perform the SIM swap. The indictment does not name those co-conspirators.

Once Council got the SIM card from AT&T, he bought a phone from an Apple store, installed the SIM card, then requested a password reset for the SEC’s X account. The password reset code went to the phone Council had, so he was then able to reset the account’s password, log in, and publish the fraudulent post announcing the approval of bitcoin ETFs.

“Today the SEC grants approval for #Bitcoin ETFs for listing on all registered national securities exchanges,” read the fraudulent post. Council also posted, “#BTC,” but then deleted it.

The plea agreement Council signed indicates his motivation was unjust enrichment; he received bitcoin payment in exchange for conducting the SIM swap, though the indictment doesn’t name who paid him.

The plea agreement also indicates that Council made various internet searches related to the scheme, including “telegram sim swap,” “how can I know for sure if I am being investigated by the FBI,” “Verizon store list,” “federal identity theft statute,” and “how long does it take to delete telegram account.”

Telegram has been the subject of international police investigations for its role in enabling crimes including fraud.

The plea agreement must be reviewed by a judge before Council is sentenced, so the 24 months of prison time is subject to change.

The scheme was enabled in part by a lack of multi-factor authentication (MFA) on the SEC’s X account. While the SEC had MFA enabled on its account in the past, X support had disabled it, at the SEC’s request, in July 2023 due to “issues accessing the account,” according to a statement the SEC issued after the unauthorized post.

The SEC has since reenabled MFA on its X account, and it is enabled on all SEC social media accounts that offer it.

The SEC also said it “does not use social media channels to make its actions public,” and rather uses social media only to “amplify announcements that are made on our website.”

Less than 36 hours after Council made the fraudulent post, the SEC released a legitimate announcement approving such ETFs — an action the chair of the SEC, Gary Gensler, said a court order issued the year prior had forced.