OAK — OnChain Attack Knowledge

Worked example · 2024-01

U.S. SEC verified X-account compromise and fake Bitcoin ETF approval — chain-agnostic — 2024-01-09

Loss
approximately $90M–$230M in aggregate crypto-derivatives market liquidations within the 15-minute window between the fake SEC @SECGov X-account post announcing Bitcoin spot ETF approval and the SEC Chair's corrective post confirming the account had been compromised. The fake post triggered an immediate Bitcoin price spike from ~$46,800 to ~$48,100 (+2.8%) within two minutes, followed by a sharp reversal to ~$45,400 (-2.9% from pre-spike) after the corrective statement. The resulting price whip liquidated both long and short leveraged positions across centralised and decentralised derivatives venues (Binance, Bybit, OKX, Hyperliquid, GMX, dYdX). The SEC itself suffered no direct financial loss, but the market-manipulation extraction through the price whip was enabled by the verified-account compromise. The FBI confirmed the compromise vector as a SIM-swap attack against the SEC's X account phone number, which had two-factor authentication disabled at the time of the incident.
OAK Techniques observed
OAK-T15.006 (Impersonation via Verified Social-Account Compromise — primary; the @SECGov X account's gold verification badge was the trust-substrate that the attacker exploited: the market treated a post from the verified SEC account as authoritative, triggering immediate algorithmic and manual trading responses before the post could be fact-checked). OAK-T17.001 (Cross-Venue Arbitrage Price Distortion — secondary; the attacker's economic extraction likely involved pre-positioned long or short positions on derivatives venues designed to profit from the price whip that the fake post would trigger, making this a T15.006-antecedent-to-T17.001-profit composite). OAK-T4 (Access Acquisition — broad construction; the SIM-swap vector that enabled the X-account compromise is an access-acquisition primitive operating at the telecom-carrier layer rather than the crypto-protocol layer).
Attribution
confirmed The FBI arrested Eric Council Jr., a 25-year-old from Athens, Alabama, in October 2024 on charges of conspiracy to commit aggravated identity theft and access-device fraud. Per the DOJ indictment, Council executed the SIM-swap using a fake ID and personally appeared at a mobile-phone store in Huntsville, Alabama, to take over the SEC employee's phone number. Council pleaded guilty in May 2025. Co-conspirators — who directed the X-account post and pre-positioned the market trades — were referenced in the indictment but not publicly named at the time of Council's plea. The attribution status is confirmed for the SIM-swap executor (Council) and inferred-strong-at-cohort-level for the trading-side co-conspirators.
Key teaching point
The SEC X-account compromise is the canonical 2024 T15.006 anchor for the highest-trust-substrate surface — a verified government-financial-regulator account — producing direct market-manipulation profit through the Bitcoin ETF approval announcement vector. The case demonstrates three structural T15.006 properties at maximum scale: (a) the platform verification signal (X gold checkmark) is the load-bearing trust-substrate — the market moved on the @SECGov post because it was verified, not because it was corroborated; (b) market-moving news delivered via a compromised verified account produces extraction not through phishing but through derivatives-positioning — the attacker does not need to phish individual victims; the price whip itself extracts from leveraged traders; (c) the SIM-swap compromise vector (telecom-carrier-layer) sits outside both the social-platform and crypto-protocol security surfaces, making it a multi-substrate T15.006 case.

Summary

On January 9, 2024, at approximately 16:11 UTC, the U.S. Securities and Exchange Commission's verified X (Twitter) account @SECGov posted a message announcing that the SEC had approved the listing of Bitcoin spot exchange-traded funds (ETFs). The post appeared on the official @SECGov account, which carried X's gold verification badge designating it as an "official government organization." The post was crafted in the SEC's formal announcement voice, included a graphic with the SEC seal, and quoted SEC Chair Gary Gensler. The cryptocurrency market — which had been anticipating a Bitcoin spot ETF approval decision for months, with a widely-expected deadline on January 10 — reacted immediately.

Within two minutes of the post, Bitcoin's price spiked from approximately $46,800 to $48,100 (+2.8%) as algorithmic trading systems, news-aggregation bots, and manual traders acted on the verified-account post. Approximately 15 minutes later, at 16:26 UTC, SEC Chair Gary Gensler posted from his personal X account (@GaryGensler) that the @SECGov account had been compromised and that the SEC had not approved Bitcoin spot ETFs. Bitcoin's price reversed sharply, falling to approximately $45,400 — a 2.9% decline from the pre-spike level. The resulting price whip (+2.8% then -5.7% from peak to trough) liquidated approximately $90M–$230M in leveraged positions across crypto-derivatives venues.

The compromise vector — per the FBI investigation and DOJ indictment — was a SIM-swap attack. Eric Council Jr. used a fake ID to impersonate the SEC employee whose phone number was linked to the @SECGov X account. Council appeared at a mobile-phone store in Huntsville, Alabama, obtained a SIM card linked to the victim's number, and used the SIM to receive the password-reset code for the @SECGov account. Critically, the SEC had disabled two-factor authentication on its X account in July 2023 at the request of X support staff, and it was not re-enabled until after the January 2024 compromise.

The SEC confirmed the compromise, the FBI initiated an investigation, and Council was arrested in October 2024 and pleaded guilty in May 2025. The co-conspirators who directed the X-account post content and pre-positioned the market trades were referenced in the indictment but not yet publicly named at the time of Council's plea. The SEC approved Bitcoin spot ETFs on January 10, 2024 — one day after the compromise — making the fake post's content directionally prescient.

For OAK's purposes, the case is the canonical 2024 T15.006 anchor for the government-financial-regulator-verified-account sub-shape: the highest-trust-substrate surface in the social-account-compromise taxonomy. The platform's verification signal (X gold checkmark) was the sole basis for the market's reaction — no corroborating announcement was published through any other SEC channel, yet the market moved on the verified post alone.

Timeline (UTC)

When Event OAK ref
2023-07 SEC disables two-factor authentication on @SECGov X account at X support's request; account protected by password + phone-number recovery only (T15.006 surface created; MFA disabled)
2024-01-09 ~pre-16:00 Eric Council Jr. executes SIM-swap at mobile-phone store in Huntsville, Alabama; takes over SEC employee's phone number; receives @SECGov password-reset code T4 (access acquisition — telecom-carrier SIM-swap)
2024-01-09 16:11 UTC @SECGov verified X account posts fake Bitcoin spot ETF approval announcement; post carries gold verification badge, SEC seal graphic, and quotes Chair Gensler T15.006 (verified-account compromise — fake announcement distribution)
2024-01-09 16:11 to 16:13 Bitcoin price spikes $46,800 → $48,100 (+2.8%); algorithmic and manual trading responds to verified-account post T17.001 (market manipulation — price spike on fake news)
2024-01-09 16:26 UTC SEC Chair Gensler posts from personal X account confirming @SECGov compromise; Bitcoin price reverses $48,100 → $45,400 (-5.7% from peak) (corrective statement; price whip second leg)
2024-01-09 16:11 to 16:40 $90M–$230M in leveraged positions liquidated across centralised and decentralised derivatives venues from the price whip T17.001 extraction (liquidation cascade on price whip)
2024-10 FBI arrests Eric Council Jr. on charges of conspiracy to commit aggravated identity theft and access-device fraud (law-enforcement attribution)
2025-05 Eric Council Jr. pleads guilty; co-conspirators referenced in indictment but not publicly named at time of plea (confirmed attribution — executor; cohort-level for trading-side)

Realised extraction

The direct extraction is the $90M–$230M in leveraged-position liquidations during the 15-minute price-whip window. The attacker's profit — pre-positioned derivatives trades on the price spike and reversal — has not been publicly quantified at the individual-co-conspirator level at the time of Council's plea, but the mechanism is inferred from the trading pattern: an attacker who pre-positioned long positions (or call options) on Bitcoin ahead of the fake post and unwound before the corrective statement, then pre-positioned short positions for the reversal, could extract profit proportional to the price amplitude. The SEC suffered no direct financial loss; the market-manipulation extraction was borne by leveraged traders whose positions were liquidated in the price whip.

Public references

  • U.S. Department of Justice — indictment and guilty plea of Eric Council Jr. (October 2024 arrest, May 2025 plea) — canonical for the attribution and SIM-swap compromise vector — [dojsecsimswap2024]
  • SEC Office of Inspector General — statement on @SECGov account compromise and multi-factor authentication status (January 2024) — [secigxaccount2024]
  • SEC Chair Gary Gensler — corrective X post from @GaryGensler confirming @SECGov compromise (January 9, 2024, 16:26 UTC) — [genslersecx2024]
  • Cointelegraph, CoinDesk, The Block, Decrypt — contemporaneous coverage of the fake ETF announcement and price whip — [cointelegraphsecx2024] [coindesksecx2024]
  • Cross-reference: T15.006 at techniques/T15.006-impersonation-via-verified-social-account-compromise.md
  • Cross-reference: examples/2025-02-solana-x-account-compromise-cohort.md — Solana brand-X-account compromise cohort (Jupiter / Pump.fun / DogWifCoin)
  • Cross-reference: examples/2022-04-bored-ape-discord-wave.md — BAYC Discord moderator verified-role compromise wave

Techniques demonstrated (3)