OAK — OnChain Attack Knowledge

Worked example · 2024-01

U.S. SEC verified X-account compromise and fake Bitcoin ETF approval — chain-agnostic — 2024-01-09

Corrected 2026-10-11
guilty-plea date (Feb 2025) and sentencing (May 2025, 14 months) fixed; the MFA-disabled finding re-attributed to the SEC's own statement; the unsupported $90M–$230M liquidation figure and "pre-positioned trades by co-conspirators" claims removed.
Loss
no verified liquidation total; the price whip occurred within the roughly 15-minute window between the fake SEC @SECGov X-account post announcing Bitcoin spot ETF approval and the SEC Chair's corrective post confirming the account had been compromised. The fake post triggered an immediate Bitcoin price spike from ~$46,800 to ~$48,100 (+2.8%) within two minutes, followed by a sharp reversal to ~$45,400 (-2.9% from pre-spike) after the corrective statement. The price whip would have hit leveraged traders on both sides; no source reviewed quantifies the resulting liquidations. The SEC itself suffered no direct financial loss. The compromise vector, per the DOJ, was a SIM-swap against the phone number tied to the SEC's X account; the SEC stated that multi-factor authentication on the account had been disabled since July 2023 at staff request and was re-enabled only after the incident.
OAK Techniques observed
OAK-T15.006 (Impersonation via Verified Social-Account Compromise — primary; the @SECGov X account's gold verification badge was the trust-substrate that the attacker exploited: the market treated a post from the verified SEC account as authoritative, triggering immediate algorithmic and manual trading responses before the post could be fact-checked). The market impact (BTC moved sharply on the false post) is recorded as context; T17.001 was removed 2026-10-11 because no source shows the attackers traded on it — DOJ says Council was paid roughly $50,000 in Bitcoin. OAK-T4 (Access Acquisition — broad construction; the SIM-swap vector that enabled the X-account compromise is an access-acquisition primitive operating at the telecom-carrier layer rather than the crypto-protocol layer).
Attribution
confirmed The FBI arrested Eric Council Jr., a 25-year-old from Athens, Alabama, in October 2024 on charges of conspiracy to commit aggravated identity theft and access-device fraud. Per the DOJ indictment, Council executed the SIM-swap using a fake ID and personally appeared at a mobile-phone store in Huntsville, Alabama, to take over the SEC employee's phone number. Council pleaded guilty in February 2025 and was sentenced in May 2025 to 14 months in prison. Co-conspirators who directed the account takeover were referenced in charging documents but not publicly named. The attribution status is confirmed for the SIM-swap executor (Council); the directing co-conspirators remain unidentified.
Key teaching point
The SEC X-account compromise is the canonical 2024 T15.006 anchor for the highest-trust-substrate surface — a verified government-financial-regulator account — producing a market-moving price whip through the Bitcoin ETF approval announcement vector. The case demonstrates three structural T15.006 properties at maximum scale: (a) the platform verification signal (X gold checkmark) is the load-bearing trust-substrate — the market moved on the @SECGov post because it was verified, not because it was corroborated; (b) market-moving news delivered via a compromised verified account moves prices not through phishing of individual victims but through the false announcement itself, which can hurt leveraged traders (profit by the attackers is unverified); (c) the SIM-swap compromise vector (telecom-carrier-layer) sits outside both the social-platform and crypto-protocol security surfaces, making it a multi-substrate T15.006 case.

Summary

On January 9, 2024, at approximately 16:11 UTC, the U.S. Securities and Exchange Commission's verified X (Twitter) account @SECGov posted a message announcing that the SEC had approved the listing of Bitcoin spot exchange-traded funds (ETFs). The post appeared on the official @SECGov account, which carried X's gold verification badge designating it as an "official government organization." The post was crafted in the SEC's formal announcement voice, included a graphic with the SEC seal, and quoted SEC Chair Gary Gensler. The cryptocurrency market — which had been anticipating a Bitcoin spot ETF approval decision for months, with a widely-expected deadline on January 10 — reacted immediately.

Within two minutes of the post, Bitcoin's price spiked from approximately $46,800 to $48,100 (+2.8%) as algorithmic trading systems, news-aggregation bots, and manual traders acted on the verified-account post. Approximately 15 minutes later, at 16:26 UTC, SEC Chair Gary Gensler posted from his personal X account (@GaryGensler) that the @SECGov account had been compromised and that the SEC had not approved Bitcoin spot ETFs. Bitcoin's price reversed sharply, falling to approximately $45,400 — a 2.9% decline from the pre-spike level. The resulting price whip (+2.8% then -5.7% from peak to trough) moved leveraged positions across crypto-derivatives venues; no source reviewed gives a verified liquidation total.

The compromise vector — per the FBI investigation and DOJ indictment — was a SIM-swap attack. Eric Council Jr. used a fake ID to impersonate the SEC employee whose phone number was linked to the @SECGov X account. Council appeared at a mobile-phone store in Huntsville, Alabama, obtained a SIM card linked to the victim's number, and used the SIM to receive the password-reset code for the @SECGov account. Critically, per the SEC's own 22 January 2024 statement, multi-factor authentication on the account had been disabled since July 2023 (at SEC staff request, after access problems) and was re-enabled only after the compromise.

The SEC confirmed the compromise, the FBI initiated an investigation, and Council was arrested in October 2024, pleaded guilty in February 2025, and was sentenced in May 2025. The co-conspirators who directed the takeover were not publicly named. The SEC approved Bitcoin spot ETFs on January 10, 2024 — one day after the compromise — making the fake post's content directionally prescient.

For OAK's purposes, the case is the canonical 2024 T15.006 anchor for the government-financial-regulator-verified-account sub-shape: the highest-trust-substrate surface in the social-account-compromise taxonomy. The platform's verification signal (X gold checkmark) was the sole basis for the market's reaction — no corroborating announcement was published through any other SEC channel, yet the market moved on the verified post alone.

Timeline (UTC)

When Event OAK ref
2023-07 SEC disables multi-factor authentication on @SECGov X account (per SEC statement); account protected by password + phone-number recovery only (T15.006 surface created; MFA disabled)
2024-01-09 ~pre-16:00 Eric Council Jr. executes SIM-swap at mobile-phone store in Huntsville, Alabama; takes over SEC employee's phone number; receives @SECGov password-reset code T4 (access acquisition — telecom-carrier SIM-swap)
2024-01-09 16:11 UTC @SECGov verified X account posts fake Bitcoin spot ETF approval announcement; post carries gold verification badge, SEC seal graphic, and quotes Chair Gensler T15.006 (verified-account compromise — fake announcement distribution)
2024-01-09 16:11 to 16:13 Bitcoin price spikes $46,800 → $48,100 (+2.8%); algorithmic and manual trading responds to verified-account post market impact (context, not a mapped Technique) — price spike on fake news
2024-01-09 16:26 UTC SEC Chair Gensler posts from personal X account confirming @SECGov compromise; Bitcoin price reverses $48,100 → $45,400 (-5.7% from peak) (corrective statement; price whip second leg)
2024-01-09 16:11 to 16:40 Price whip across derivatives venues; liquidation totals unverified market impact (context)
2024-10 FBI arrests Eric Council Jr. on charges of conspiracy to commit aggravated identity theft and access-device fraud (law-enforcement attribution)
2025-02 Eric Council Jr. pleads guilty (confirmed attribution — executor)
2025-05-16 Council sentenced to 14 months in prison; directing co-conspirators not publicly named (confirmed attribution — executor)

Realised extraction

No source reviewed quantifies liquidations or attacker trading profit. The only documented proceeds are the roughly $50,000 in Bitcoin that DOJ says Council received for the SIM swap. Whether the attackers positioned trades around the post is unverified. The SEC suffered no direct financial loss; the price whip fell on leveraged traders.

Public references

Techniques demonstrated (2)