How Twitter was hacked in a gigantic bitcoin scam.

    Major US Twitter accounts hacked in Bitcoin scam.

    Multiple high-profile Twitter accounts were hijacked on Wednesday, with some of the platform's top voices - including President Barack Obama, Joe Biden, Elon Musk, Bill Gates, Kanye West, Michael Bloomberg, and Apple - used to solicit digital currency.

    Twitter completely disabled the ability for verified accounts to send new tweets following the massive hack. Unverified accounts were still able to tweet normally, and verified accounts appeared to be able to retweet existing tweets.

    "Everyone is asking me to give back," a tweet from Mr Gates' account said. "You send $1,000, I send you back $2,000."

    In the four hours the tweets were live, the bitcoin wallet promoted in the tweets received over $120,000 via at least 300 transactions.

    But how did this happened?

    The company revealed that its own internal employee tools were compromised and used in the hack.

    “We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools,” the first tweet in a multi-tweet explainer thread reads. “We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf.”

    A Twitter insider was responsible for a wave of high profile account takeovers, according to leaked screenshots obtained by Motherboard and two sources who took over accounts. Various underground hacking circles have been sharing screenshots of an internal company admin tool allegedly used to conduct the account takeovers, potentially by resetting account email accounts and then recovering passwords. In an update to its investigation on the hack, Motherboard now says it’s talked to hackers who say they paid a Twitter employee to change the email addresses of popular accounts using the internal tool so that they could then take control of them.

    Motherboard also shared some of the screenshots of the internal tool allegedly at the center of the hacks, including one here in which Motherboard redacted sensitive account info. Twitter is reportedly suspending accounts that share the screenshots and manually removing them for violating its rules.

    The company says it’s currently investigating “what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it.” It’s theoretically possible that attackers may have had access to private direct messages, for instance.

    Twitter will now likely face serious questions about its internal security precautions and the protections it has in place to prevent this from ever happening again or from resulting in far more catastrophic consequences in the future. It’s quite possible Twitter will find itself facing government inquiries and investigations.

    Update

    Hackers targeted 130 high profile accounts using tools which are only available to the internal support team. They managed to initiate password reset on 45 accounts, login to the account and send tweets. Moreover, the hackers exported data from as many as 8 accounts using the "Your Twitter Data" tool. Twitter says "We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts." Twitter also says "We hope that our openness and transparency throughout this process, and the steps and work we will take to safeguard against other attacks in the future, will be the start of making this right."