Loading story…
Twitter suffered a major breach in which attackers hijacked prominent accounts including those of Barack Obama, Joe Biden, Elon Musk, Bill Gates, and Jeff Bezos and used them to post a Bitcoin-doubling scam. The fraudulent messages urged followers to send cryptocurrency to attacker-controlled wallets, exploiting the credibility and reach of the compromised accounts to amplify the fraud.
Twitter said the intrusion stemmed from a social engineering attack against employees that gave the attackers access to internal administrative tools, while reports also raised the possibility that an insider may have been paid or otherwise assisted. In response, the company locked affected accounts and temporarily restricted all verified accounts from posting until it could restore access safely and contain the incident.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Twitter said the incident was caused by a social engineering attack against its employees that leveraged internal administrative tools. The company also investigated whether an employee directly hijacked the accounts or provided attackers access to the internal tool.
During the breach response, Twitter temporarily locked the compromised accounts and also restricted all verified accounts in an unprecedented step. The company said access would be restored only when it could do so securely, and later began restoring tweeting functionality to affected accounts.
On 2020-07-16, attackers took over numerous prominent Twitter accounts, including those of Barack Obama, Joe Biden, Elon Musk, Bill Gates, and Jeff Bezos, and used them to post Bitcoin-doubling scam messages. One of the first suspicious tweets was sent from Elon Musk’s account, directing victims to attacker-controlled cryptocurrency addresses.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised Twitter employee access through a **coordinated social engineering campaign** and used the company’s internal account-management tools to seize control of numerous high-profile accounts, including those of **Barack Obama, Joe Biden, Bill Gates, Elon Musk, Jeff Bezos, Apple, Uber, and Warren Buffett**. The hijacked accounts posted fraudulent messages promising to double any bitcoin sent to an attacker-controlled wallet, which collected more than **$100,000** in cryptocurrency within hours. Twitter removed the tweets, locked affected accounts, and temporarily restricted posting and other functions for verified users as it investigated whether additional data, including direct messages or other account information, had been accessed. Reporting indicated the attackers may initially have been focused on hijacking coveted “OG” usernames and may have ties to the **OGUsers** gray-market forum, where access to Twitter accounts was allegedly advertised before the breach. Twitter said about **130 accounts** were targeted, though only a smaller subset was fully controlled, and the incident raised broader concerns because the platform is used by political leaders, major corporations, and financial markets; the **FBI** opened an investigation, lawmakers sought briefings, and Twitter shares fell in after-hours trading as the company worked to contain what was described as one of the most serious security failures in its history.
Jun 29, 2026
Twitter said attackers used social engineering against employees to gain access to internal tools, then targeted 130 accounts and successfully reset passwords, logged in to, and tweeted from 45 of them as part of a high-profile bitcoin scam. The takeover hit prominent accounts including those of Barack Obama, Joe Biden, Bill Gates, Jeff Bezos, Elon Musk, and Kanye West, while the company later disclosed that attackers also downloaded account data from eight users whose accounts were not verified. Twitter later confirmed the attackers accessed the direct-message inboxes of up to 36 targeted accounts, including one elected official in the Netherlands, reportedly Geert Wilders, though it said it had no evidence other current or former elected officials were similarly affected. As the FBI investigated and lawmakers pressed for answers, Coinbase said it blocked roughly 1,100 customers from sending funds to the scam wallet addresses, preventing more than **$280,000** in bitcoin transfers, although about 14 users still sent roughly **$3,000** before the blacklist took effect.
Jun 29, 2026
Twitter faced a high-profile account takeover that compromised prominent accounts and triggered a federal investigation led by the **FBI**, according to Reuters. The incident raised concerns about how attackers accessed internal tools and used them to hijack verified profiles, turning the breach into a major national cybersecurity and platform-trust issue. In the aftermath, Twitter rolled out security changes aimed at hardening internal access, including requiring **security keys** for employees to reduce the risk of similar compromises. The response highlighted the role of employee-access protections and privileged-tool controls in defending social media platforms against attacks that can rapidly spread fraud, disinformation, and reputational damage.
Jul 12, 2026