You&#x27;d think a 0day like that would be worth much more than the BTC they&#x27;re going to receive.

This must be a twitter exploit. Just too many high profile accounts have been pushing out scams at the same time.

Some of these are really high profile hacks (Biden&#x2F;Obama for eg). I&#x27;m wondering if its a silly twitter authentication bypass.

My bet is on some kind of client&#x2F;marketing platform that all these accounts gave write permission to.Edit: I stand corrected, many other comments mention that the offending tweets appear to be posted from the web app, so this suggests an issue within Twitter itself.

Lots and lots of crypto accounts hacked. Either Twitter is hacked or some automated tweeting system has a 0day.

<a href="https:&#x2F;&#x2F;gifyu.com&#x2F;image&#x2F;QrnS" rel="nofollow">https:&#x2F;&#x2F;gifyu.com&#x2F;image&#x2F;QrnS</a>

That sounds like a... high variance idea.

There are quite a lot of trading bots that base their trades off high impact twitter accounts. I wonder how they would&#x27;ve reacted to this.

With the way that Elon tweets normally, someone could have done a lot of damage before anyone realized. Luckily markets have closed already.

BillGates tweet is now down, within the last minute.

They are reposting the same message on the hacked accounts again. This is a coordinated Twitter hack.

One thing we know now is that Twitter can take tweets down really quickly if they want.

Tweet is down now, but still in Google&#x27;s cache.

We don’t know how much of that is the attacker sending himself to make it look legit.

To be fair this does seem like something Elon would do

&gt; As of now, 121 people have sent cash totally more than 2.5BTC.Fool and his money are soon parted.

<a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>5.9BTC now

This one&#x27;s a bit more up-to-date: <a href="https:&#x2F;&#x2F;blockchair.com&#x2F;bitcoin&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;blockchair.com&#x2F;bitcoin&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

That explorer probably does not count unconfirmed transactions.

Where did you get the 2.5BTC number from?It&#x27;s more like 1.3BTC by looking up the address on their website.<a href="https:&#x2F;&#x2F;bitref.com&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;bitref.com&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wl...</a>Edit: I stand corrected. Holy crap!

They do often supply some coins to themselves to create the illusion that there is activity.

I few weeks ago I saw two with 50k each...Google has to step up it&#x27;s game because their platforms aren&#x27;t safe anymore.

I&#x27;ve seen several live streams on youtube that replay spacex launches and display the same offer.  Viewership goes up during actual launches.  The one I found had 10k active viewers and the address they linked to had brought in 2btc in under an hour.

&gt; What is going on that Twitter didn&#x27;t get them locked ASAP?I don&#x27;t think Twitter itself knows yet.

I&#x27;m amazed that accounts at the scale of Elon and Bill Gates weren&#x27;t locked down within moments. They&#x27;ve been reposting these for at least 30 minutes.What is going on that Twitter didn&#x27;t get them locked ASAP?Also all of Apple&#x27;s tweets deleted, and now posting the bitcoin thing as well: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;Apple&#x2F;status&#x2F;1283506278707408900" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;Apple&#x2F;status&#x2F;1283506278707408900</a>

Easier to trace, higher monetary investment etc. This they can likely get away with without risk of losing a big investment.

That&#x27;s way riskier though. There&#x27;s a reason they are using BTC.

It would be also much easier to track. Significant gains this way would not go unnoticed.

Do you know they haven’t shorted twitter? Lots of ways to play this game.

&quot;Hacking Elon’s Twitter account and using it for a crypto scam rather than a stock-trading scam shows a complete lack of imagination&quot; - Naval<a href="https:&#x2F;&#x2F;twitter.com&#x2F;naval&#x2F;status&#x2F;1283507218294292481?s=19" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;naval&#x2F;status&#x2F;1283507218294292481?s=19</a>

Or SPX puts, &#x2F;ES futures, etc and a tweet from a certain political account...

The hacker could have puts on Twitter as well. The Bitcoin scam might be just a cover &#x2F; distraction so it looks like an unsophisticated hacker while the real money might be made with options contracts.

What makes you think they have not bet on stock as well?

Couldn&#x27;t market-traded options be rolled back in the event of a hack, though?

My crazy theory: the real attack is on the Twitter stock price and the bitcoin is a distraction.

They could have just bought puts on twitter as it is currently down 4% after hours.

It&#x27;s not 100% guaranteed though; Tesla stock is odd. And it might be possible to people short selling who timed it exactly right.This &quot;scam&quot;, while crude, will probably not result in any loss and it would be much harder to catch them

The attack didn&#x27;t start until after the markets closed.

This is the route I would have taken, but not with OTM puts. It’s far easier to let the stock tank, then buy up calls knowing that the reason is bullshit, and wait for the price to recover and sell.You will blend in perfectly because you have an alibi for why you are buying so many TSLA calls.And when you buy an OTM put, it’s hard to predict what a good price would be exactly. How far do you think the stock would drop? With a call you could be fairly more confident it will return to a previous level.That said, this kind of attack requires you to have a good amount of capital on hand, so you need to be a fairly independently wealthy hacker.

The SEC would be able to trace the trades, and the person would be busted. Bitcoin allows them to remain anonymous.

Sounds like &quot;committing suicide&quot; in a US super max with extra steps.Golden rule is you don&#x27;t steal money from rich people, only poors.

It would be ridiculously easy to track down those puts and narrow them to a possible hacker. Authorities would find them in hours.

Honestly, we should be relieved if thats all that was stolen. A more sophisticated attack would involve OTM puts on TSLA and a tweet along the lines of: &quot;finding major defects in Ys and 3s. shutting down all lines to reconfigure for a week&quot;That could have netted the attackers millions.

Haha, I apologise in advance, but for some reason, the tone of your post just made me chuckle. It just had an amusing sort if naivite&#x27;. It was most likely the hacker&#x27;s own BTC address.

Presumably, there was a fake BTC address to go along with that tweet? Otherwise I assume Musk would just return any money...

This strategy would require having money to begin with. It&#x27;s a pretty big assumption that hackers have any money. If they had money, they wouldn&#x27;t have to be hackers.

They could have inconspicuously joined the numerous TSLA shorters and made 100x that with one tweet

I mean why can they not stop the api? Why not just switch it off for a few minutes and figure out what is happening?

My bet is that some Tweet posting API is missing a critical authentication check or the hackers found a way to bypass this check.I doubt someone could individually hack all these accounts.

Barack Obama, Wiz Khalifa, Joe Biden, Floyd Mayweather as well

Lots of them have been hacked: <a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2020&#x2F;7&#x2F;15&#x2F;21326200&#x2F;elon-musk-bill-gates-twitter-hack-bitcoin-scam-compromised" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2020&#x2F;7&#x2F;15&#x2F;21326200&#x2F;elon-musk-bill-g...</a>

And just as I checked it, they pinned this tweet (an hour later)--Elon Musk
@elonmusk·38sI am giving back to my community due to Covid-19!All Bitcoin sent to my address below will be sent back doubled. If you send $1,000, I will send back $2,000!bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlhOnly doing this for the next 30 minutes! Enjoy.

It&#x27;s a sidenote, but it&#x27;s so strange that that would be pocket money for him; just like donating 10$ for us. Gives you a sense of scale.

Joe Biden too. “He was ‘giving back to the community’” if you sent him money. They tailored the messages pretty well, I have to say.Bezos “was maxing out at 50MM”!!

can you post how you track the wallet this is going into? Thanks.EDIT: Someone already did:<a href="https:&#x2F;&#x2F;bitref.com&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;bitref.com&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wl...</a>

Elon Musk as well. Tweets still up, saying &quot;Feeling greatful, doubling all payments sent to my BTC address!You send $1,000, I send back $2,000!
Only doing this for the next 30 minutes.&quot;As of now, 121 people have sent cash totally more than 2.5BTC.Edit: Just seen @BillGates compromised as well, same bitcoin account.Edit 2: Elon&#x27;s tweet seems to be getting removed, and then reposted again shortly after. About $40k sent so far.Edit 3: Interesting to watch - on both accounts, tweets seem to be deleted and then reappear as pinned a few mins later.

There&#x27;s a Web Archive link[0] for anyone curious.It looks like this was pretty successful for the hacker. At the time of writing they received ~3.1 BTC, or ~$29k in USD[1].Edit: Replaced [1] with a site that appeared to have less trackers according to Privacy Badger.[0]: <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20200715202030&#x2F;https:&#x2F;&#x2F;twitter.com&#x2F;elonmusk&#x2F;status&#x2F;1283495825998520320" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20200715202030&#x2F;https:&#x2F;&#x2F;twitter.c...</a>[1]: <a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

Those are some big names.  I got notified about Elon and bill gates, figured there was some large scale hack.  Crazy times

Partial list of hacked accounts here, <a href="https:&#x2F;&#x2F;twitter.com&#x2F;Justin12393LEE&#x2F;status&#x2F;1283498445886586883" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;Justin12393LEE&#x2F;status&#x2F;128349844588658688...</a>Mentions:
- Bitcoin
- Coinbase
- BINANCE 
- CZ_Binance 
- Gemini
- Kucoin
- Gate .io
- Coindesk
- Tron
- Justin Sun
- Charlee Lee

This must be a shot over someone&#x27;s bow.Edit: Or a trading play? That would have taken place while the markets were open, though. TWTR after-hours trading is off 3% on the news.

Some pics of the tweets: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;TheHackersNews&#x2F;status&#x2F;1283502081265950720" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;TheHackersNews&#x2F;status&#x2F;128350208126595072...</a>

Some folks are saying some of these accounts had 2FA, so can be the case but I guess if it was a system thing, we might have seen tweets from more prominent accounts.

I believe I read something (trying to find it) about Twitter internally having additional protections on Trump&#x27;s account. Only a handful of people within Twitter can touch it.

They&#x27;re clearly trying to avoid the risk of being tracked. For example, they could have done stock manipulation and made more money. Trump is someone with the power and craziness to spend a hundred million tracking you down and literally dropping bombs on your head. So it&#x27;d be poor risk management to go after his account.

You would think they would do something with Trump if it was arbitrary accounts. But maybe his has additional protections

No. Clicking into a tweet shows you which app was used to post it. <a href="https:&#x2F;&#x2F;help.twitter.com&#x2F;en&#x2F;using-twitter&#x2F;how-to-tweet#source-labels" rel="nofollow">https:&#x2F;&#x2F;help.twitter.com&#x2F;en&#x2F;using-twitter&#x2F;how-to-tweet#sourc...</a>These tweets are showing up as being posted from the Twitter web interface.

One theory is it&#x27;s a tweet scheduling platform, rather than Twitter itself that was hacked.

Might be a third party client, browser extension, insider threat... not necessarily a compromise of the Twitter backend.

Suggestion on Twitter is a third-party app that has write access to the accounts was compromised.

I do not think that a 3rd party tweet scheduling program has been hacked, because the tweets say they have been sent by “Twitter Web App”. Maybe the new feature on twitter.com to schedule tweets has a security vulnerability?

The email address associated with the account(s) appear to have been changed as well: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;sniko_&#x2F;status&#x2F;1283485972286656517" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;sniko_&#x2F;status&#x2F;1283485972286656517</a>

So many accounts are affected, this seems to be a system-level hack rather than a compromise of individual accounts.Someone has found a way to post a tweet from any account they like?

- Uber- Apple- Bill Gates- Elon Musk- Jeff Bezos- Joe Biden- Barack Obama- Michael Bloomberg- Kanye West- Wiz Khalifa- Bitcoin- Ripple- Coinbase- BINANCE- CZ_Binance- Gemini- Kucoin- Gate .io- Coindesk- Tron- Justin Sun- Charlee LeeThat seems like someone got full access to the backend, not the accounts per se.Also worth mentioning that the tweets get deleted but then they get added and pinned again.

Based on this, a metric fuckton of small accounts are posting this as well right now. Unless you hacked the backend I don&#x27;t see why you&#x27;d bother with 200 follower accounts.<a href="https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh&amp;src=typed_query&amp;f=live" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p8...</a>

&gt; Whoever hacked @Twitter today definitely got major access to their backendIs there any proof Twitter was hacked and not just these two accounts?

Whoever hacked Twitter today definitely got major access to their backend: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;whoisjuan&#x2F;status&#x2F;1283502962103455744?s=20" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;whoisjuan&#x2F;status&#x2F;1283502962103455744?s=2...</a>

Pics of tweets: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;TheHackersNews&#x2F;status&#x2F;1283502081265950720" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;TheHackersNews&#x2F;status&#x2F;128350208126595072...</a>

I believe OP meant that the attackers got access to the account by hacking SMS, thus getting the verification code and legitimately logging in the accounts.

Is there a way to pin a tweet via SMS? I don&#x27;t think so... and these tweets are getting pinned.

I meant in the sense of SIM-swap hacks, though SMS-posting would also make sense as a vector (had Twitter not recently ended it)<a href="https:&#x2F;&#x2F;info.phishlabs.com&#x2F;blog&#x2F;sim-swap-attacks-two-factor-authentication-obsolete" rel="nofollow">https:&#x2F;&#x2F;info.phishlabs.com&#x2F;blog&#x2F;sim-swap-attacks-two-factor-...</a>

Twitter dropped support for SMS posting earlier this year:<a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2020&#x2F;4&#x2F;27&#x2F;21238131&#x2F;twitter-sms-notifications-disabled-jack-dorsey-hack" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2020&#x2F;4&#x2F;27&#x2F;21238131&#x2F;twitter-sms-noti...</a>

&gt; At least some of the compromised accounts have multi-factor authentication enabled, including CoinDesk&#x27;s.Interesting. I wonder if it was a SMS hack, and if not, then a new kind of vulnerability?

When I posted my comment the title simply read &quot;twitter compromised&quot;. I&#x27;m not sure if the exact nature of the attack is known, but it definitely wasn&#x27;t at the time.

Surely a hack of this magnitude would be on the radar of many of those agencies already.

Biden &#x2F; Obama would fall in that too though?

I like to imagine that it would trigger some kind of alarm at the CIA&#x2F;NSA&#x2F;FBI and have drones surrounding the person&#x27;s house within a few hours?

Perhaps Twitter has additional security around his account?  An IP whitelist? Perhaps the President has a special version of the twitter client that includes additional authentication? Twitter is no fan of the current president, but it seems plausible for national security reasons.

&gt; multi-factor authentication enabledIt sure seems like multi-factor auth isn&#x27;t very helpful, when nearly all hacks have nothing to do with breaking credentials.

Sounds like an exploit. The article says that some of the accounts were confirmed to have multi-factor authentication enabled.

Reminds me of the iCloud phishing hack, a lot of high profile celebrities were hacked that time.

Wouldn&#x27;t Twitter have locked the affected accounts by now then?

The leaked credentials of an employee at a tweet scheduling service theory sounds more plausible to me on the face of it.

bug exploit or some kind of inside access

Well then we&#x27;re royally fucked if all it takes is a single rogue admin at this single, societally ubiquitous company to expose everything and let people fire off false declarations of war on each other or short TSLA and additionally make the entire concept of 2FA meaningless.This was exactly what 2FA was supposed to prevent, and if this is to be believed then because of Twitter&#x27;s implementation it was all worth peanuts in the end.There are just too many eyes on Twitter for their administration to let this happen. Twitter has grown into too big and too valuable of a target at this point, and the moment this happens you can&#x27;t prevent dumb people from falling for it thirty seconds after it gets posted and starts showing up in their feed.Then why was it even possible to do this from the inside? What employee access controls did they have on administrative accounts?I&#x27;m thinking they&#x27;re going to need to dig an underground bunker and have everyone be in the presence of at least three other certified minders when a group of two dozen people at a tech startup are the last bastion of hope in preventing the disruption of global communications.

How many people have admin access to production? That is like a &quot;in case of emergency break glass&quot;-role at best.

Betting on inside &#x2F; direct database access or admin account.

Going differently, an internal API for managing accounts was exposed externally or not authorized correctly.

Way too many high profile accounts for phishing

Place your bets, phishing or bug exploit. Some of these targets are too high profile to all fall for it and probably have teams that manage these accounts securely. Edit: 2fa was bypassed, interesting. <a href="https:&#x2F;&#x2F;twitter.com&#x2F;tylerwinklevoss&#x2F;status&#x2F;1283492017889259523" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;tylerwinklevoss&#x2F;status&#x2F;12834920178892595...</a>

A clear use case of Blockchain for the cryptocurrency detractors \s

This is looking really bad, I wonder what they used to get access to all these high-profile accounts?It&#x27;s worth noting these types of blackhat crypto scammers make millions a year from this already, but this is definitely making it a lot worse.EDIT: Still going on after 30+ minutes, seeing people like Bill Gates tweet crypto scams still. Amazed they got all the crypto exchange too.And it&#x27;s not just Bitcoin, they got RIpple too and posted XRP addresses.

This is going to be a hilarious postmortem. If we ever see it.

Some reports that this was related to compromised OAuth tokens. How would someone know and what is the source of the compromise? A third party app that all of these accounts use?

The responses to that tweet say it is fake and the real number is only 6BTC (~$50k).

<a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;it&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;it&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtz...</a>According to this, 6.1 BTC, which is around 56k USD

Seems they’re cashing in. According to one tweet, $7.8m transferred to their address so far.

Pretty safe to assume they are all compromised until there is proof to the contrary.

It&#x27;s amusing that the tweets keep coming, get deleted, reappear, get deleted...I can&#x27;t help but imagine how any account on twitter would be safe if the Bill Gates&#x27;, Elon Musk&#x27;s, and top crypto site&#x27;s Twitters are compromised.

Partially because it&#x27;s twitter, I&#x27;m completely unable to determine if the responses are hacked accounts, joking, or actual people that sent money.I suspect the actual numbers and percentages of the whole of each would be surprising...

Still going on. <a href="https:&#x2F;&#x2F;twitter.com&#x2F;BillGates&#x2F;status&#x2F;1283503731682811907" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;BillGates&#x2F;status&#x2F;1283503731682811907</a> What a disaster this stuff. Wonder how it was done.

also all @apple tweets have been deleted lol 
the hacker already got 6 BTC!
this is crazy.

Parent wallet (the one posted on twitter) now transfering funds to this wallet: <a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;1Ai52Uw6usjhpcDrwSmkUvjuqLpcznUuyF" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;1Ai52Uw6usjhpcDrwSmkU...</a>

The wallet that the hacker who got Elon posted has been given 5.7 BTC and counting: <a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

I refuse to believe there are people who can be aware of BTC enough to go out of their way to even obtain some, and then fall for a scam like this...

The scammer&#x27;s address: <a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh?page=1" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

There are services that are able to obfuscate a transfer of BTC, which really only makes it very laborious to trace the money.

There are many exchanges and services where you can sell BTC for XMR (Monero) without revealing your identity. And with Monero you cannot trace addresses or transactions.

I am not familiar with BTC markets. How would they be able to collect? Wouldn&#x27;t everyone be watching that wallet like hawk, making it impossible to withdraw without revealing their identity?

I’m sure they’ll hold onto them, considering they ran a scam on one of the world’s richest people who made the NSA’s favorite operating system.

God, imagine them declaring war on China from Trump’s Twitter...

Playing in the market leaves substantially more of a trail to follow.

Seems like a very paltry sum compared to other ways they could have capitalized on market-moving tweets.

The attacker already made over 5 BTC:<a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

Really surprised by this. I suspect a system-level 2FA hack or a bug exploit, all these people woudln&#x27;t fall for phishing

Still going on as of this post time. Elon&#x27;s just went off again.Over 30ish minutes now. Holy shit, it&#x27;s going to be fun to see the outcome of this.

For someone that doesn&#x27;t understand twitter, what does that mean?

That&#x27;s not new. AFAIK, Apple promotes all of their tweets, so they don&#x27;t show up on their profile.

All of Apple&#x27;s tweets are gone<a href="https:&#x2F;&#x2F;twitter.com&#x2F;Apple" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;Apple</a>

Archive of Elon&#x27;s tweet <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20200715203559&#x2F;https:&#x2F;&#x2F;twitter.com&#x2F;elonmusk" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20200715203559&#x2F;https:&#x2F;&#x2F;twitter.c...</a>

That&#x27;s really light in details, TC has more juice about the situation IMHO: <a href="https:&#x2F;&#x2F;techcrunch.com&#x2F;2020&#x2F;07&#x2F;15&#x2F;twitter-accounts-hacked-crypto-scam&#x2F;" rel="nofollow">https:&#x2F;&#x2F;techcrunch.com&#x2F;2020&#x2F;07&#x2F;15&#x2F;twitter-accounts-hacked-cr...</a>

I thought that vulnerability was due to the now-deprecated Tweet by Phone integration and SIM swaps?

I feel like we already knew this when Jack Dorsey&#x27;s Twitter account was hacked.

That&#x27;s one of the few accounts that might get you drone striked for messing with. It may stay safe.

Would be too obvious. Noone believes what that account tweets anyway.

Yeah, I bet they&#x27;re too stupid to be able to do it.(He said, taunting the hackers.)

One wonders if that specific account has some unique exemption in the Twitter code to specifically deal with it.

Risk&#x2F;reward for the sitting POTUS just isn&#x27;t there.

Don&#x27;t worry guys I just changed my password.

They haven&#x27;t yet gone after the most prominent Twitter user.

I wonder if Elon is a type of guy who uses apps like Buffer or Social media manager app. It looks more like some exploit within Twitter which they&#x27;ve leveraged and orchestrated a coordinated tweet attack

They seem to have more access than purely posting as the user, I&#x27;m seeing reports that the attacker has changed the email addresses associated with the accounts to protonmail addresses.

All the big names hit said &quot;Twitter Web App&quot; as the tweet source.

Surely any individual client would have had their api keys immediately blocked. It would have to be more like a compromise of, say, the API key back end that allows them to surveil logins over a period of time, and the accounts we are seeing hacked is what they scraped.

I&#x27;m guessing a social media manager application got compromised, or an exploit in Twitter&#x27;s API that allows you to post as someone else. It&#x27;s hard to see all these different accounts falling for the same scam + not having 2FA, etc.

Uber has been hacked as well. At this point, they can get any high profile Twitter user.EDIT: You know this is a coordinated Twitter hack when they have Apple&#x27;s account hacked [0]. <a href="https:&#x2F;&#x2F;twitter.com&#x2F;Apple&#x2F;status&#x2F;1283506278707408900" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;Apple&#x2F;status&#x2F;1283506278707408900</a>

These are already removed.  Does anyone have a screenshot or other archive?

rumors say the hacker got access to an internal (used by employees) admin panel...

Apple never tweeted anything (only promotional ad tweets)

All Apple Tweets are now deleted<a href="https:&#x2F;&#x2F;twitter.com&#x2F;apple" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;apple</a>
and now one scam alone 
<a href="https:&#x2F;&#x2F;twitter.com&#x2F;Apple&#x2F;status&#x2F;1283506278707408900" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;Apple&#x2F;status&#x2F;1283506278707408900</a>

Apple too: <a href="https:&#x2F;&#x2F;imgur.com&#x2F;ZvPshMX.jpg" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;ZvPshMX.jpg</a>

I posted this here and it got flagged.<a href="https:&#x2F;&#x2F;twitter.com&#x2F;asculthorpe&#x2F;status&#x2F;1283501026281127937" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;asculthorpe&#x2F;status&#x2F;1283501026281127937</a>Try to warn people and you get slammed for it.Ugh.

It&#x27;s common to &quot;seed the tip jar&quot; by transferring some of your own BTC from another wallet to the public facing one. So that number should be treated like a ceiling.

It&#x27;s probably because the subset of people who would fall for it likely don&#x27;t have BTC.

An incredibly number of people in the entire world who have seen these tweets, and currently, 5:16 eastern, shows 271 transactions.Not like everyone who sees these tweets has bitcoin accounts, but less than 300 falling for the fake tweets is such a small number in terms of populations.

So far people have sent:Transactions
253Total Received
$101,539.14Link to address:<a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

Apple didn&#x27;t have any normal tweets before the incident as well. Apple only post sponsored tweets.

Did the hackers remove all tweets from Apple? Wtf

Cryptocurrency scams with fake accounts impersonating verified ones have been around for years despite being detectable with a simple regex. There&#x27;s no reason to believe this disgraceful company actually cares, although after this incident hopefully they will change their mind.

It&#x27;s astonishing that they can&#x27;t seem to at least shut the platform down. Have they lost control completely or do they think it&#x27;s preferable to let the scammers go on than to close shop?

This is the earliest non-deleted tweet I&#x27;ve found referencing the bitcoin address (or rather, noticing that an account got hacked). It was sent at 12:23PM Pacific time (more than 1.5 hours ago): <a href="https:&#x2F;&#x2F;twitter.com&#x2F;lawmaster&#x2F;status&#x2F;1283481418518208513" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;lawmaster&#x2F;status&#x2F;1283481418518208513</a>

The scammer has got $100k and counting in less than 30mins. WOW 2020.

I can&#x27;t believe Twitter haven&#x27;t managed to stop this yet!

<a href="https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh%20filter%3Averified&amp;src=typed_query&amp;f=live" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p8...</a>Added &quot;filter:verified&quot; to queryEdit: Add @JoeBiden to the list.

How do we know that it&#x27;s not the actual OP trying to pose like a big account target?

Wow, it&#x27;s not just big accounts, it&#x27;s like anyone or everyone.

12 BTC so far... <a href="https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh?page=65" rel="nofollow">https:&#x2F;&#x2F;www.blockchain.com&#x2F;btc&#x2F;address&#x2F;bc1qxy2kgdygjrsqtzq2n...</a>

Loads of accounts still tweeting it in realtime. Follow it live: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh&amp;src=typed_query&amp;f=live" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p8...</a>

Jeff Bezos just got hit as well:<a href="https:&#x2F;&#x2F;twitter.com&#x2F;JeffBezos&#x2F;status&#x2F;1283508547897171969" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;JeffBezos&#x2F;status&#x2F;1283508547897171969</a>

Love how they don&#x27;t just ban the bitcoin address. Firehose big data my ass. No one at home at Twitter.

Searching for the bitcoin address in twitter gives an absolute ton of results. Are all these accounts hacked, or are people now posting just to joke around?

That probably gets the secret service involved, no?

Biden:<a href="https:&#x2F;&#x2F;twitter.com&#x2F;JoeBiden&#x2F;status&#x2F;1283512317846659073" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;JoeBiden&#x2F;status&#x2F;1283512317846659073</a>

Bezos is probably a great guy to hang out with, but do not expect him do boy you a beer :)

On a light note: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;lendamico&#x2F;status&#x2F;1283510105170948096" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;lendamico&#x2F;status&#x2F;1283510105170948096</a>

Bezos now, too!<a href="https:&#x2F;&#x2F;twitter.com&#x2F;JeffBezos&#x2F;status&#x2F;1283508547897171969" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;JeffBezos&#x2F;status&#x2F;1283508547897171969</a>

I couldn’t imagine this being anything other than misdirection. All major registrars do anonymization for free as an opt out. You can manage to fully compromise a giant company but are stupid enough to untick aN important box? Not likely.

The domain associated with first round of tweets wasn&#x27;t anonymized.Could be a setup <a href="https:&#x2F;&#x2F;twitter.com&#x2F;jfbsbnix&#x2F;status&#x2F;1283487977591767041" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;jfbsbnix&#x2F;status&#x2F;1283487977591767041</a>Or maybe a dodge <a href="https:&#x2F;&#x2F;twitter.com&#x2F;verretor&#x2F;status&#x2F;1283506654521094146" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;verretor&#x2F;status&#x2F;1283506654521094146</a>

There is no loosing in doing so: just put a padlock on verified mesages and show the signing key. If the message sounds fishy and it&#x27;s not verified then you should start worrying.We&#x27;ve had the technology to avoid these sort of issues for decades and it&#x27;s a shame it&#x27;s still largely unused. Yeah, I know the argument PGP usability is really bad but it doesn&#x27;t mean Twitter or other network used as official channels can&#x27;t provide their own friendly interface and start signing&#x2F;verifying messages, they certainly have the resources.

Should Twitter start supporting cryptographically signed messages? In any case, I wonder about the legal ramifications of this kind of event, for Twitter and for the individuals that have been hacked.

&quot;Something something blockchainbc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh&quot;

Oh wow, now they&#x27;re doing multiple tweets&#x2F;minute: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh&amp;src=typed_query&amp;f=live" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p8...</a>It might make sense for Twitter to redirect all non-retweets of that address to &#x2F;dev&#x2F;null (or a sandbox) for a little while.

Jeff Bezos too.<a href="https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;Zd668ao" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;Zd668ao</a>

Poll: Will this affect your trust in Twitter as a source of information?  If no, why not?

At this point I&#x27;d advocate for a huge red button or a gong that someone can smash and it just halts the platform

Yeah, I would have guessed a platform like Twitter would have anti-abuse systems with at least term filters.

If this exploit is deep enough, the attackers might be disabling the anti-abuse systems as well.

The ones I saw from Musk, Buffett etc had the actual address.

In the article it shows the tweet isn&#x27;t a bitcoin address, its just a link to another site which presumably has the actual scam.

It&#x27;s absolutely crazy. This doesn&#x27;t look like just leaked keys - it looks like genuine, manual access to accounts (as well as automated). The whole system must be compromised. @kanye replied to the scam tweet with &quot;Sent out over $2,000,000!&quot; [1].[1]: <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;wN7u43C.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;wN7u43C.png</a>

Um why not enough and not too much? This alone doesn&#x27;t say anything in regard to twitter&#x27;s user count.This means twitter had omni backend tooling that have manual&#x2F;programmatic admin level access to production database.This is a very bad idea, access to production tables should be through a controlled medium and always challenged.

On a serious note, does that 4000+ employees include the content moderators? If yes, then I can see why. If not, then I am not sure what that many employees is for.

I can&#x27;t count the number of times people have asked here &quot;How can Twitter possibly employ 4,000+ employees?&quot;.  Well, I suppose we&#x27;ve learned 4K isn&#x27;t even enough for good anti-abuse systems.

Daaaaaaamn! I bet morale really has deteriorated since national politics leaked into business decisions and employees being cut off from their daily social interactions isn&#x27;t helping.

They might be too busy renaming all their &#x27;master&#x27; branches.

Just what kind of an operation is Twitter running here? It seems crazy that they don&#x27;t have any kind of anti-abuse system in place that could just block tweets with this specific Bitcoin address or possibly tweets matching the regexp of any Bitcoin address. I.e. limit the damage and buy a couple of hours while they try to find the root cause.(Yes, yes, staged rollouts. But anti-abuse systems don&#x27;t work by those rules, at least in emergencies.)

How did they possibly steal Elon Musk&#x27;s Twitter account? We need a post-mortem on this because if he can be phished, then we need to know how, and if it was some internal hack then I also need to know how. That&#x27;s extremely scary!

Twitter should just ban all Btc address posting momentarily until this is solved

Listing some out that I&#x27;ve seen:@Apple
@Uber
@elonmusk
@kanye
@MikeBloomberg
@JoeBiden
@WarrenBuffet
@wizkhalifa
@BarackObama
@JeffBezos
@MrBeastYT
@FloydMayweather
@LuckyovLegends
@xxxtentacion

I don’t think I’ve ever looked forwards to a postmortem so much, so many possibilities.

Twitter hasn&#x27;t released postmortems for other incidents, so I wouldn&#x27;t hold out hope

boy I sure hope we get a juicy post mortem, this is quite a scam

With so many accounts compromised, the hackers might actually have full access to Twitter&#x27;s backend. The postmortem would be very interesting. I&#x27;ll be looking forward to it.Imagine if the hackers timed the intrusion during github outage, and twitter&#x27;s employees can&#x27;t deploy a fix for the exploit fast enough because github was down!

Hackers take over prominent Twitter accounts in simultaneous attack