Eric Council Jr., the SIM swap hacker who helped compromise the Securities and Exchange Commission’s X account last year, made $50,000 performing similar attacks and even searched how to tell if the FBI is investigating him, recent filings show.

The recent filing was part of the prosecutor’s request to sentence him to two years in prison over his role in the hack, which saw the SEC X account publish a false announcement that a spot Bitcoin exchange-traded fund was approved, shaking up the markets. 

Council searched: “How can I know for sure if I am being investigated by the FBI” and “How long does it take to delete Telegram account,” US prosecutors discovered following a search warrant of his house, car and devices last June, according to a May 12 court filing.

While Council’s Telegram chats were set up to be removed after two weeks, US prosecutors still found chats of Council discussing SIM swaps with others believed to be located overseas.

Council also admitted to law enforcement that he received around $50,000 for performing SIM swaps for clients between January to June 2024. He advertised himself as a SIM swapping expert on Telegram under the username easymunny, offering services for payment between $1,200 and $1,500.

How Eric Council Jr. pulled the hack off, then got caught

Council executed the SIM swap by creating fake identity documents to specifically impersonate someone that his co-conspirators identified as having access to the SEC’s X account.

These fake documents were then used to trick a staff worker at telecommunications firm AT&T into reassigning the victim’s phone number to Council’s SIM card. 

Council inside an AT&T Store on Jan. 9, 2024. Source: US Government

Council had to share the last four digits of the victim’s Social Security number and driver’s license to effectuate the SIM swap.

He then bought a new iPhone from an Alabama Apple store, inserted the new SIM and shared the access codes to the SEC’s X account with his co-conspirators, who later posted the fake news about the spot Bitcoin ETFs on Jan. 9. The Bitcoin products received official approval the following day.

Council received payment for the SEC SIM swap in Bitcoin (BTC) and other cryptocurrencies, the prosecutors said.

However, Council’s luck ran out on June 12, 2024, when surveillance agents observed him attempting to execute a SIM swap at an Apple store, impersonating another victim.

Law enforcement executed a search warrant six days later and recovered several pieces of circumstantial evidence, including templates for fake identification cards on his laptop.

Two fake ID documents recovered from Council’s Telegram account. Source: US Government

He pleaded guilty on Feb. 10, after a federal grand jury returned an indictment charging him with Conspiracy to Commit Aggravated Identity Theft and Access Device Fraud last October.

Related: SEC Chair: Blockchain ‘holds promise’ of new kinds of market activity

The fake post accumulated over 1 million views before the SEC confirmed it had been hacked roughly 15 minutes later.

The two announcements resulted in Bitcoin’s price initially rising $1,000 before abruptly falling nearly $2,000 shortly after, wiping out tens of millions of dollars worth of market positions.

The security team at X confirmed that the SEC didn’t have two-factor authentication installed on its X account at the time of the incident. The SEC claimed it initially had 2FA enabled but was erroneously removed by X Support following a request by an SEC staff member.

Magazine: Japanese porn star’s coin red flags, Alibaba-linked L2 runs at 100K TPS

The government of Dubai has signed an agreement with crypto exchange Crypto.com to launch crypto payments for government services. 

The agreement, formalized during the Dubai fintech Summit on May 12, is part of Dubai’s cashless strategy, which hopes to foster the city’s transition to “a fully digital, cashless society,” by introducing “a new digital payment channel across its official platforms,” the Dubai Department of Finance (DOF) said on May 12.

Once the service goes live, individuals and business customers of government entities can pay service fees with crypto through Crypto.com’s digital wallets. The payments will be converted into dirhams and transferred to DOF accounts, according to the DOF.

Amna Mohammed Lootah, director of digital payment systems regulation, stated that Dubai’s plan is for 90% of financial transactions across the public and private sectors to be powered through cashless methods by 2026.

“We are confident that this milestone will significantly accelerate the advancement of the Dubai Cashless Strategy,” she said. 

The DOF didn’t specifically mention which crypto it would start accepting, but did say the payments could be made using “stable cryptocurrencies,” possibly indicating stablecoins will be allowed.  

A trio of major Abu Dhabi institutions, including the Emirate’s sovereign wealth fund, announced on April 28 a plan to launch a new dirham-pegged stablecoin.

Dubai’s strategy hopes to spark fintech sector expansion 

The city’s cashless strategy was first announced in October 2024. At the time, the DOF said 97% of all government payments in 2023 were already digital. 

The strategy has also been predicted to add at least 8 billion dirhams ($2.1 billion) to the economy, according to the DOF, fuelled by the development of financial technology services and the accelerated expansion of Dubai’s fintech sector. 

Ahmad Ali Meftah, executive director of the central accounts sector at DOF, said in a statement the government is still actively developing a regulatory framework that “fosters innovation while ensuring the highest standards of security and efficiency” in digital financial transactions.

Ahmad Ali Meftah (left) said the government is still working on a crypto regulatory framework. Source: Dubai Department of Finance

Dubai is considered a crypto-friendly city. The emirate hosted the Dubai edition of Token2049 between April 30 and May 1 this year. 

Related: Dubai gov’t agencies to link real estate registry with property tokenization

Meanwhile, on March 19, the Dubai government started the pilot phase of a project to convert real estate assets into digital tokens on the blockchain. 

Other governments have also floated using crypto for payments. A New York lawmaker introduced legislation in April to allow state agencies to accept crypto payments. 

Magazine: DeFi will rise again after memecoins die down: Sasha Ivanov, X Hall of Flame

The government of Dubai has signed an agreement with crypto exchange Crypto.com to launch crypto payments for government services. 

The agreement, formalized during the Dubai fintech Summit on May 12, is part of Dubai’s cashless strategy, which hopes to foster the city’s transition to “a fully digital, cashless society,” by introducing “a new digital payment channel across its official platforms,” the Dubai Department of Finance (DOF) said on May 12.

Once the service goes live, individuals and business customers of government entities can pay service fees with crypto through Crypto.com’s digital wallets. The payments will be converted into dirhams and transferred to DOF accounts, according to the DOF.

Amna Mohammed Lootah, director of digital payment systems regulation, stated that Dubai’s plan is for 90% of financial transactions across the public and private sectors to be powered through cashless methods by 2026.

“We are confident that this milestone will significantly accelerate the advancement of the Dubai Cashless Strategy,” she said. 

The DOF didn’t specifically mention which crypto it would start accepting, but did say the payments could be made using “stable cryptocurrencies,” possibly indicating stablecoins will be allowed.  

A trio of major Abu Dhabi institutions, including the Emirate’s sovereign wealth fund, announced on April 28 a plan to launch a new dirham-pegged stablecoin.

Duiba’s strategy hopes to spark fintech sector expansion 

The city’s cashless strategy was first announced in October 2024. At the time, the DOF said 97% of all government payments in 2023 were already digital. 

The strategy has also been predicted to add at least 8 billion dirhams ($2.1 billion) to the economy, according to the DOF, fuelled by the development of financial technology services and the accelerated expansion of Dubai’s fintech sector. 

Ahmad Ali Meftah, executive director of the central accounts sector at DOF, said in a statement the government is still actively developing a regulatory framework that “fosters innovation while ensuring the highest standards of security and efficiency” in digital financial transactions.

Ahmad Ali Meftah (left) said the government is still working on a crypto regulatory framework. Source: Dubai Department of Finance

Dubai is considered a crypto-friendly city. The emirate hosted the Dubai edition of Token2049 between April 30 and May 1 this year. 

Related: Dubai gov’t agencies to link real estate registry with property tokenization

While on March 19, the Dubai government started the pilot phase of a project to convert real estate assets into digital tokens on the blockchain. 

Other governments have also floated using crypto for payments. A New York lawmaker introduced legislation in April to allow state agencies to accept crypto payments. 

Magazine: DeFi will rise again after memecoins die down: Sasha Ivanov, X Hall of Flame

Corporations and businesses are the largest net buyers of Bitcoin so far this year, outpacing exchange-traded funds and retail investors, according to new research. 

Firms such as Michael Saylor’s Strategy have bought more Bitcoin (BTC) this year than any other category of investor, with overall corporate holdings growth totalling 157,000 BTC, worth around $16 billion at current prices, according to Bitcoin investment firm River. 

Strategy makes up 77% of the group’s growth, the firm reported on X on May 12, before adding that it’s not just big companies.

“We’re seeing businesses across all industries sign up to River. They’re aligned with Bitcoin and how it can change their future,” the firm noted.  

The next largest category after corporations was ETFs, which have grown their net Bitcoin by 49,000 BTC, or $5 billion worth, reported River. Following that were governments with around 19,000 BTC in growth, and retail traders or individuals had seen a decline of 247,000 in Bitcoin holdings this year, it reported. 

Change in BTC ownership in 2025. Source: River

Overall, there has been a 154% growth in business ownership since 2024, the firm stated, breaking things down by business category for its own clients.

It revealed that finance and investment firms are the largest buyers of the asset, with 35.7% of the total, followed by tech firms on 16.8%, professional and consulting companies accounted for 16.5%, and the remainder were real estate, non-profits, consumer and industrial, healthcare, and energy, agriculture, and transportation firms. 

Related: Coinbase considered Saylor-like Bitcoin strategy before opting out: Bloomberg

There have been several large corporate purchases recently, with Strategy scooping up a whopping 13,390 Bitcoin for $1.34 billion and Metaplanet adding a further 1,241 BTC to its treasury, which surpassed that of El Salvador on May 12. 

Newcomers to the Bitcoin market in 2025 include video streaming platform Rumble, which made its first purchase in March, Hong Kong construction firm Ming Shing, and Hong Kong investment firm HK Asia Holdings Limited. 

At least twelve public companies bought Bitcoin for the first time in Q1 2025, reported Bitwise in April. The firm added that the amount of Bitcoin held on the books of publicly traded companies rose by 16% for the period, with more than 95,000 Bitcoin added to corporate portfolios for the period. 

Is Bitcoin becoming deflationary?

These big corporate purchases of the asset will put pressure on the supply and demand since supply is finite, and miners can only produce 450 coins per day, say analysts.

CryptoQuant CEO and market analyst Ki Young Ju said Strategy is accumulating Bitcoin at a faster rate than total miner output, giving the asset a -2.3% annual deflation rate. 

Meanwhile, author Adam Livingston recently said that Strategy is synthetically halving Bitcoin by outpacing miner supply through high demand.

Magazine: Bitcoin eyes ‘crazy numbers,’ JD Vance set for Bitcoin talk: Hodler’s Digest

Corporations and businesses are the largest net buyers of Bitcoin so far this year, outpacing exchange-traded funds and retail investors, according to new research. 

Firms such as Michael Saylor’s Strategy have bought more Bitcoin (BTC) this year than any other category of investor, with overall corporate holdings growth totalling 157,000 BTC, worth around $16 billion at current prices, according to Bitcoin investment firm River. 

Strategy makes up 77% of the group’s growth, the firm reported on X on May 12, before adding that it’s not just big companies.

“We’re seeing businesses across all industries sign up to River. They’re aligned with Bitcoin and how it can change their future,” the firm noted.  

The next largest category after corporations was ETFs, which have grown their net Bitcoin by 49,000 BTC, or $5 billion worth, reported River. Following that were governments with around 19,000 BTC in growth, and retail traders or individuals had seen a decline of 247,000 in Bitcoin holdings this year, it reported. 

Change in BTC ownership in 2025. Source: River

Overall, there has been a 154% growth in business ownership since 2024, the firm stated, breaking things down by business category for its own clients.

It revealed that finance and investment firms are the largest buyers of the asset, with 35.7% of the total, followed by tech firms on 16.8%, professional and consulting companies accounted for 16.5%, and the remainder were real estate, non-profits, consumer and industrial, healthcare, and energy, agriculture, and transportation firms. 

Related: Coinbase considered Saylor-like Bitcoin strategy before opting out: Bloomberg

There have been several large corporate purchases recently, with Strategy scooping up a whopping 13,390 Bitcoin for $1.34 billion and Metaplanet adding a further 1,241 BTC to its treasury, which surpassed that of El Salvador on May 12. 

Newcomers to the Bitcoin market in 2025 include video streaming platform Rumble, which made its first purchase in March, Hong Kong construction firm Ming Shing, and Hong Kong investment firm HK Asia Holdings Limited. 

At least twelve public companies bought Bitcoin for the first time in Q1 2025, reported Bitwise in April. The firm added that the amount of Bitcoin held on the books of publicly traded companies rose by 16% for the period, with more than 95,000 Bitcoin added to corporate portfolios for the period. 

Is Bitcoin becoming deflationary?

These big corporate purchases of the asset will put pressure on the supply and demand since supply is finite, and miners can only produce 450 coins per day, say analysts.

CryptoQuant CEO and market analyst Ki Young Ju said Strategy is accumulating Bitcoin at a faster rate than total miner output, giving the asset a -2.3% annual deflation rate. 

Meanwhile, author Adam Livingston recently said that Strategy is synthetically halving Bitcoin by outpacing miner supply through high demand.

Magazine: Bitcoin eyes ‘crazy numbers,’ JD Vance set for Bitcoin talk: Hodler’s Digest

The X account of the Ethereum layer 2 network ZKsync and its developer Matter Labs were compromised early on May 13, with hackers falsely claiming the network was being probed by US authorities, among other scam messages.

A ZKsync-related X account posted on May 13, confirming the accounts for ZKsync and Matter Labs were compromised, warning users not to interact after the accounts shared links to a fake airdrop in an apparent phishing scam.

Other X users had warned the ZKsync X account was compromised. Source: pseudo

The hacked ZKsync and Matter Labs then both posted a fake statement claiming ZKsync was under investigation by the US Securities and Exchange Commission and that the Treasury Department could impose sanctions on the platform.

Matter Labs communications head Lynnette Nolan confirmed to Cointelegraph that the now-deleted X post “is not legit” and both accounts are now “fully back in the control of the team.”

“Shoutout to the zksync hackers. Instead of dropping a token and stealing a few bucks they decided to scare the living shit out of onchain degens,” crypto startup g8keep co-founder Harrison Leggio, who goes by “Pop Punk,” posted to X.

Source: Harrison Leggio

The fake statement was seemingly aimed at crashing the price of the platform’s self-titled token, ZKsync (ZK), which has fallen around 2% in the last hour amid the X account breach, according to CoinGecko.

The SEC has investigated crypto companies in the past, and many of these firms have chosen to publicly disclose when they’ve been investigated by the regulator.

The SEC has stopped many of its probes under the Trump administration, with Crypto.com, Immutable, OpenSea and RobinHood Crypto, among others, confirming the agency had ended investigations.

ZK is down 6.4% over the last day to trade at around 7 cents, cooling from a nearly 38.5% rally it’s enjoyed over the past week.

Related: US prosecutors want 2 years for SEC X account hacker

Matter Labs’ Nolan said the firm was looking into how the X accounts were breached, and believed it was via “compromised delegated accounts,” which allow users limited access to an X account, allowing them to post on its behalf.

Two hacks in as many months

It’s the second compromise of ZKsync-controlled platforms since April.

On April 15, an attacker breached the admin account of ZKsync’s airdrop distribution contract and used a function to mint 111 million unclaimed ZK tokens, worth approximately $5 million at the time.

The hack happened amid the platform handing out 17.5% of ZK’s supply to ecosystem participants.

The attacker later returned 90% of the stolen tokens, agreeing to keep 10% as a bounty.

Magazine: ZK-proofs are bringing smart contracts to Bitcoin — BitcoinOS and Starknet

The X account of the Ethereum layer 2 network ZKsync and its developer Matter Labs were compromised early on May 13, with hackers falsely claiming the network was being probed by US authorities, among other scam messages.

A ZKsync-related X account posted on May 13, confirming the accounts for ZKsync and Matter Labs were compromised, warning users not to interact after the accounts shared links to a fake airdrop in an apparent phishing scam.

Other X users had warned the ZKsync X account was compromised. Source: pseudo

The hacked ZKsync and Matter Labs then both posted a fake statement claiming ZKsync was under investigation by the US Securities and Exchange Commission and that the Treasury Department could impose sanctions on the platform.

Matter Labs communications head Lynnette Nolan confirmed to Cointelegraph that the now-deleted X post “is not legit” and both accounts are now “fully back in the control of the team.”

“Shoutout to the zksync hackers. Instead of dropping a token and stealing a few bucks they decided to scare the living shit out of onchain degens,” crypto startup g8keep co-founder Harrison Leggio, who goes by “Pop Punk,” posted to X.

Source: Harrison Leggio

The fake statement was seemingly aimed at crashing the price of the platform’s self-titled token, ZKsync (ZK), which has fallen around 2% in the last hour amid the X account breach, according to CoinGecko.

The SEC has investigated crypto companies in the past, and many of these firms have chosen to publicly disclose when they’ve been investigated by the regulator.

The SEC has stopped many of its probes under the Trump administration, with Crypto.com, Immutable, OpenSea, and RobinHood Crypto, among others, confirming the agency had ended investigations.

ZK is down 6.4% over the last day to trade at around 7 cents, cooling from a nearly 38.5% rally it’s enjoyed over the past week.

Related: US prosecutors want 2 years for SEC X account hacker

Matter Labs’ Nolan said the firm was looking into how the X accounts were breached, and believed it was via “compromised delegated accounts,” which allow users limited access to an X account, allowing them to post on its behalf.

Two hacks in as many months

It’s the second compromise of ZKsync-controlled platforms since April.

On April 15, an attacker breached the admin account of ZKsync’s airdrop distribution contract and used a function to mint 111 million unclaimed ZK tokens, worth approximately $5 million at the time.

The hack happened amid the platform handing out 17.5% of ZK’s supply to ecosystem participants.

The attacker later returned 90% of the stolen tokens, agreeing to keep 10% as a bounty.

Magazine: ZK-proofs are bringing smart contracts to Bitcoin — BitcoinOS and Starknet

Crypto bank Anchorage Digital has expanded its stablecoin offerings with the acquisition of Mountain Protocol, a stablecoin issuer that says it will begin winding down its main stablecoin, Mountain USD (USDM).

The acquisition, which is subject to customary closing conditions and regulatory approval, will integrate the Mountain Protocol team, tech stack and licensing framework into Anchorage’s existing offerings, Anchorage said in a May 12 statement.

While terms of the deal weren’t disclosed, it reflects an accelerating number of acquisitions between crypto and TradFi firms in recent months.

Explaining the acquisition, Anchorage CEO Nathan McCauley said stablecoins are becoming the backbone of the crypto economy, while anticipating that “every business” will eventually use stablecoins as part of their operations.

Source: Anchorage Digital

Mountain Protocol CEO Martin Carrica said the company’s expertise in stablecoins, combined with Anchorage’s crypto infrastructure, positions the merged entities to meet rising global demand for stablecoin services.

Anchorage is the only federally chartered digital asset bank in the US, while Mountain Protocol’s stablecoin services are regulated by the Bermuda Monetary Authority.

It comes around nine months after Anchorage introduced a stablecoin rewards program for institutions holding the PayPal USD (PYUSD) stablecoin.

Mountain Protocol’s USDM to wind down

As part of the acquisition, Mountain Protocol said it would begin an “orderly wind-down process” for USDM, which operates as a yield-bearing stablecoin.

Mountain Protocol said it ceased minting the stablecoin on May 12 but noted that USDM rewards will remain active for another 30 days. After that, the reward rate will be set to 0% APY.

The stablecoin issuer’s customers can redeem their USDM through the firm’s platform, while other USDM holders are encouraged to swap the stablecoin for other tokens on exchanges.

Related: ‘Dark stablecoins’ could emerge as regulations tighten

Mountain Protocol’s Ethereum-based USDM is not to be confused with Mehen Finance’s USDM stablecoin, which runs on the Cardano network. 

Mountain Protocol’s USDM saw considerable success shortly after launching in late 2023, rising to a $155 million market cap by March 2024, according to RWA.xyz. However, its market cap has since fallen below $50 million.

RWA.xyz estimates there are around 10,820 USDM holders.

Magazine: Crypto wanted to overthrow banks, now it’s becoming them in stablecoin fight

Update May 13, 12:33 am UTC: This article has been updated to include more information from Curve Finance.

Decentralized finance (DeFi) protocol Curve Finance has warned that a hacker has again hijacked its domain name system (DNS), sending users to a malicious website.  

In the second attack on its infrastructure in a week, the “curve.fi DNS might be hijacked. Don’t interact!” the team said in a May 12 warning to X.

In a follow-up post to a user asking whether it was a hack or a hijack, the Curve Team said the website “Points to the wrong IP” when users try to visit. A DNS works like a directory that translates domain names into IP addresses. 

Source: Curve Finance

The team also said in another update that the “Password is secure,” its two-factor authentication was set up a “long time ago,” and a question has been sent to the “registrar now.”

”While all smart contracts are safe, the domain name points to a malicious site which can drain your wallet! We are investigating and working on recovering the access. No sign of a compromise on our side,” Curve said.

Source: Curve Finance

Curve Finance was hit with a similar front end attack in August 2022. In a post-mortem,  the consensus was that the attackers managed to clone the Curve Finance website and reroute the DNS server to the fake page.

Users who attempted to use the platform had their funds drained into a pool operated by the attackers.

Cointelegraph has contacted Curve Finance for comment.

Curve Finance potential front-end attack

Onchain security firm Blockaid also detected unusual activity from the Curve website recently, warning users to stay away and avoid interacting for now.

It could be a case of a “potential frontend attack,” according to the security firm, which is when hackers target the part of the website users interact with, such as the buttons, forms, or text on the site, to steal sensitive data.

Source: Blockaid

“If you’re connected, please refrain from signing transactions and avoid interactions with the DApp until the issue is resolved. We’re working closely with affected partners. More updates soon,” Blockaid said.

Related: Crypto hackers hit DeFi for $92M in April as attacks double from March

Second attack in a week

This is the second time Curve Finance has been targeted in the last week. On May 5, a hacker took over its official X handle.

“To clarify: the incident was limited strictly to the X account. No other Curve accounts were affected. No security issues were found on our side, no user funds were impacted, and there were no victims of phishing links that the hacker posted,” the team said in a follow-up May 6 post. 

Source: Curve Finance

Access to the Curve Finance X account was restored quickly, and the cause is still under investigation.

A slew of other high-profile X accounts have also been taken over by bad actors this year. On May 2, the Tron DAO account was hijacked; meanwhile, on April 15, a member of the UK’s Parliament, Lucy Powell, had her account taken over to promote a scam crypto token called the House of Commons Coin (HOC).

Magazine: Financial nihilism in crypto is over — It’s time to dream big again

Decentralized finance (DeFi) protocol Curve Finance has warned that a hacker has again hijacked its domain name system (DNS), sending users to a malicious website.  

In the second attack on its infrastructure in a week, the “curve.fi DNS might be hijacked. Don’t interact!” the team said in a May 12 warning to X.

In a follow-up post to a user asking whether it was a hack or a hijack, the Curve Team said the website “Points to the wrong IP” when users try to visit. A DNS works like a directory that translates domain names into IP addresses. 

Source: Curve Finance

The team also said in another update that the “Password is secure,” its two-factor authentication was set up a “long time ago,” and a question has been sent to the “registrar now.””While all smart contracts are safe, the domain name points to a malicious site which can drain your wallet! We are investigating and working on recovering the access. No sign of a compromise on our side,” Curve said.

Curve Finance was hit with a similar front end attack in August 2022. In a post-mortem,  the consensus was that the attackers managed to clone the Curve Finance website and reroute the DNS server to the fake page.

Users who attempted to use the platform had their funds drained into a pool operated by the attackers.

Cointelegraph has contacted Curve Finance for comment.

Curve Finance potential front-end attack

Onchain security firm Blockaid also detected unusual activity from the Curve website recently, warning users to stay away and avoid interacting for now.

It could be a case of a “potential frontend attack,” according to the security firm, which is when hackers target the part of the website users interact with, such as the buttons, forms, or text on the site, to steal sensitive data.

Source: Blockaid

“If you’re connected, please refrain from signing transactions and avoid interactions with the DApp until the issue is resolved. We’re working closely with affected partners. More updates soon,” Blockaid said.

Related: Crypto hackers hit DeFi for $92M in April as attacks double from March

Second attack in a week

This is the second time Curve Finance has been targeted in the last week. On May 5, a hacker took over the official X handle.

“To clarify: the incident was limited strictly to the X account. No other Curve accounts were affected. No security issues were found on our side, no user funds were impacted, and there were no victims of phishing links that the hacker posted,” the team said in a follow-up May 6 post. 

Source: Curve Finance

Access to the Curve Finance X account was restored quickly, and the cause is still under investigation.

A slew of other high-profile X accounts have also been taken over by bad actors this year. On May 2, the Tron DAO account was hijacked; meanwhile, on April 15, a member of the UK’s Parliament, Lucy Powell, had her account taken over to promote a scam crypto token called the House of Commons Coin (HOC).

Magazine: Financial nihilism in crypto is over — It’s time to dream big again