SEC hacker once Googled ‘if I am being investigated by the FBI’

Eric Council Jr., the SIM swap hacker who helped compromise the Securities and Exchange Commission’s X account last year, made $50,000 performing similar attacks and even searched how to tell if the FBI is investigating him, recent filings show.

The recent filing was part of the prosecutor’s request to sentence him to two years in prison over his role in the hack, which saw the SEC X account publish a false announcement that a spot Bitcoin exchange-traded fund was approved, shaking up the markets. 

Council searched: “How can I know for sure if I am being investigated by the FBI” and “How long does it take to delete Telegram account,” US prosecutors discovered following a search warrant of his house, car and devices last June, according to a May 12 court filing.

While Council’s Telegram chats were set up to be removed after two weeks, US prosecutors still found chats of Council discussing SIM swaps with others believed to be located overseas.

Council also admitted to law enforcement that he received around $50,000 for performing SIM swaps for clients between January to June 2024. He advertised himself as a SIM swapping expert on Telegram under the username easymunny, offering services for payment between $1,200 and $1,500.

Council executed the SIM swap by creating fake identity documents to specifically impersonate someone that his co-conspirators identified as having access to the SEC’s X account.

These fake documents were then used to trick a staff worker at telecommunications firm AT&T into reassigning the victim’s phone number to Council’s SIM card. 

Council had to share the last four digits of the victim’s Social Security number and driver’s license to effectuate the SIM swap.

He then bought a new iPhone from an Alabama Apple store, inserted the new SIM and shared the access codes to the SEC’s X account with his co-conspirators, who later posted the fake news about the spot Bitcoin ETFs on Jan. 9. The Bitcoin products received official approval the following day.

Council received payment for the SEC SIM swap in Bitcoin (BTC) and other cryptocurrencies, the prosecutors said.

However, Council’s luck ran out on June 12, 2024, when surveillance agents observed him attempting to execute a SIM swap at an Apple store, impersonating another victim.

Law enforcement executed a search warrant six days later and recovered several pieces of circumstantial evidence, including templates for fake identification cards on his laptop.

He pleaded guilty on Feb. 10, after a federal grand jury returned an indictment charging him with Conspiracy to Commit Aggravated Identity Theft and Access Device Fraud last October.

Related: SEC Chair: Blockchain 'holds promise' of new kinds of market activity

The fake post accumulated over 1 million views before the SEC confirmed it had been hacked roughly 15 minutes later.

The two announcements resulted in Bitcoin’s price initially rising $1,000 before abruptly falling nearly $2,000 shortly after, wiping out tens of millions of dollars worth of market positions.

The security team at X confirmed that the SEC didn’t have two-factor authentication installed on its X account at the time of the incident. The SEC claimed it initially had 2FA enabled but was erroneously removed by X Support following a request by an SEC staff member.

Magazine: Japanese porn star’s coin red flags, Alibaba-linked L2 runs at 100K TPS