SEC Hacker Asked Google If He Was Being Investigated—Turns Out, He Was

Eric Council Jr., the SIM swap hacker involved in last year’s breach of the SEC's X (formerly known as Twitter) account, allegedly earned $50,000 through similar attacks and was found to have searched for information on how to determine if the FBI was investigating him.

According to recent court filings, these revelations came to light as part of the prosecution's push for a two-year prison sentence for Council's role in the hack, which falsely claimed that the SEC had approved a spot Bitcoin exchange-traded fund, causing market disruption.

Prosecutors discovered that Council had Googled “How can I know for sure if I am being investigated by the FBI” and “How long does it take to delete a Telegram account” during an investigation that included a search warrant for his home, car, and devices in June 2024.

Despite his Telegram chats being set to auto-delete after two weeks, investigators uncovered messages in which Council discussed SIM swapping techniques with individuals believed to be overseas.

Additionally, Council admitted to law enforcement that he had earned approximately $50,000 from SIM swap operations between January and June 2024, advertising his services on Telegram under the username “easymunny,” charging between $1,200 and $1,500 per transaction.

Two counterfeit identification documents were discovered in Council’s Telegram account during the investigation

Hack First, Panic Later: How Eric Council Jr. Took Down the SEC and Himself

Council orchestrated the SIM swap attack on the SEC’s X account by using forged identity documents to impersonate an individual identified by his co-conspirators as having access to the account.

With these fake documents, Council tricked an AT&T employee into transferring the victim's phone number to his own SIM card.

On 9 January 2024, Council was captured inside an AT&T store, where he was executing a critical step in his scheme

To complete the SIM swap, Council provided the last four digits of the victim's Social Security number and driver’s license.

He then purchased a new iPhone in Alabama, inserted the SIM, and shared the SEC X account access codes with his co-conspirators.

This led to the infamous January post about the approval of a spot Bitcoin ETF, a claim that caused significant market volatility.

The post, which was quickly confirmed as fake, triggered a brief surge in Bitcoin's price by $1,000, followed by a sharp decline of nearly $2,000, causing substantial losses.

Council was paid in Bitcoin and other cryptocurrencies for his role in the hack.

However, his activities began to unravel on 12 June 2024, when surveillance agents spotted him attempting another SIM swap at an Apple store.

Six days later, law enforcement executed a search warrant, uncovering circumstantial evidence, including fake ID templates stored on his laptop.

Council pleaded guilty on 10 February after a grand jury indicted him on charges of conspiracy to commit aggravated identity theft and access device fraud.

The SEC confirmed that the X account lacked two-factor authentication (2FA) at the time of the breach.

While the SEC initially had 2FA enabled, it was mistakenly removed by X Support following a request from an SEC staff member.