khoji parkCrypto · San Francisco, California · 2020
Famous Twitter Accounts Asked Followers to Send Bitcoin
Attackers hijacked 130 accounts to run a crypto doubling scheme.
Read in slides1. Mass Compromise
On July 15, 2020, between 20:00 and 22:00 UTC, outside parties compromised 130 high-profile Twitter accounts. The unauthorized posts promoted a bitcoin scam asking individuals to send cryptocurrency to specific wallets. Hackers promised that money sent would be doubled and returned within minutes. Multiple high-profile accounts fell victim during the coordinated intrusion.
The fraudulent tweets spread rapidly across the platform.
2. Targeted Profiles
The first scam messages appeared on accounts with short names, followed by cryptocurrency platforms like Coinbase and Binance. The breach then expanded to prominent figures including Elon Musk, Barack Obama, Joe Biden, Bill Gates, and Jeff Bezos. Corporate accounts such as Apple, Uber, and Cash App were also affected. Most targeted profiles had at least a million followers.
Major public figures saw unauthorized posts published.
3. Financial Yield
The scam tweets claimed the sender would repay users double the value of sent bitcoin as a charity or relief effort. The first observed wallet received over 320 transactions valued at more than $110,000 before scam messages were removed. Security experts characterized the operation as a smash and grab designed for quick returns. Coinbase later reported stopping over 1,000 transactions totaling more than $280,000.
Public blockchain records tracked the rapid cryptocurrency transfers.
4. Platform Response
By 21:45 UTC, Twitter released a statement acknowledging a security incident affecting accounts. The company disabled the ability for verified users to tweet and blocked password resets. Twitter reported that credentials were restored to rightful owners approximately three hours after the first scam tweets. CEO Jack Dorsey called it a tough day for the company.
Platform administrators worked to lock down vulnerable systems.
5. Administrative Breach
Investigations revealed that attackers used social engineering against Twitter employees to gain access to internal administrative tools. Attackers scraped LinkedIn to find employees with administrative privileges and obtained private contact information. Using phone spear phishing, attackers directed remote employees to log into a fake VPN. Stolen credentials allowed attackers to bypass two-factor authentication protections.
Internal support tools provided unauthorized account control.
6. Federal Investigation
The Federal Bureau of Investigation launched an investigation into the cryptocurrency fraud on July 16, 2020. Committees in the United States Senate and the United Kingdom's National Cyber Security Centre also engaged with Twitter regarding the breach. Security researchers linked the origin of the attack to members of the OGUsers forum. The forum was known for trafficking in hacked social media credentials.
Law enforcement agencies coordinated cross-border criminal investigations.
7. Initial Charges
The United States Department of Justice announced charges against three individuals on July 31, 2020. A 19-year-old from the United Kingdom and a 22-year-old from Florida faced federal charges. Graham Ivan Clark, a 17-year-old from Florida, was indicted as an adult on 30 felony counts including organized fraud. Clark pleaded not guilty in August 2020 before accepting a plea agreement.
Prosecutors pursued federal and state criminal charges.
8. Juvenile Sentencing
In March 2021, Graham Ivan Clark accepted a plea bargain and was sentenced under Florida's Youthful Offender Act. The sentence required three years in prison followed by three years of probation. Legal provisions allowed him to serve portion of his time in a military-style boot camp facility. Other suspects faced separate indictments as federal investigations continued.
The primary juvenile architect received a custodial sentence.
9. Extradition and Conviction
In April 2023, British citizen Joseph James O'Connor was extradited from Spain to New York. O'Connor faced federal charges for hacking over 100 Twitter accounts and extorting close to $800,000 in cryptocurrency. He entered a guilty plea and received a five-year federal prison sentence in June 2023. The court also ordered the forfeiture of at least $794,000 in illicit proceeds.
Extradited conspirators faced federal prosecution in New York.
10. Security Overhaul
Investigators brought charges against identified participants in the 2020 account hijacking, and later court proceedings produced prison sentences. Twitter’s account-recovery and internal-access systems had been used to reach prominent accounts; the public Bitcoin messages were the visible result. The funds sent by victims and the access used by the intruders were separate parts of the investigation, rather than evidence that every account owner had endorsed the offers.
The messages came from hijacked accounts rather than their owners.