The 2020 Twitter Hack: How the Bitcoin Scam Worked

On the afternoon of July 15, 2020, some of the most followed accounts on Twitter started posting the same strange offer. Barack Obama, Joe Biden, Elon Musk, Bill Gates, Jeff Bezos, Apple, Uber and dozens of others all said roughly the same thing: they were "giving back," and any bitcoin sent to a certain address would be returned doubled, but only for the next 30 minutes.

The address was bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh, the same string that forms the name of this website. Nobody was giving anything back. A small group of young hackers had taken over Twitter's own internal tools, and for a few hours they could post from almost any account on the platform.

This page explains how they got in, what they did with the access, how much money they took, and what happened to them afterwards. Every figure comes from court records, regulators or blockchain analysts, listed at the bottom.

The short version

• When: July 15, 2020, roughly 2 p.m. to 8 p.m. Eastern time (about 18:00 to 00:00 UTC).
• How: The attackers phoned Twitter employees, pretended to be the company's IT help desk, and steered them to a fake VPN login page. With those logins they reached an internal admin tool.
• Scale: 130 accounts were targeted. 45 were used to tweet, up to 36 had their private messages accessed, and 7 had their data downloaded.¹
• Money: More than $100,000 in bitcoin, sent by ordinary people who believed the posts.⁵
• Aftermath: Four people were charged. Two of them are known to have been sentenced to prison.

Step one: phone calls and a fake VPN page

The attack did not start with a clever piece of code. It started with phone calls.

In March 2020 Twitter, like most tech companies, had sent its staff home because of the pandemic. Employees now reached internal systems through a VPN, and VPN trouble had become a routine reason to call IT. According to the investigation later published by the New York State Department of Financial Services (DFS), the hackers used exactly that. On the afternoon of July 14, they began calling Twitter employees, introduced themselves as the IT help desk, and said they were following up on a VPN problem.¹

They sent each employee to a website that looked like Twitter's VPN login page. What the employee typed was passed straight to the real login page in real time, which triggered the usual two-factor prompt on the employee's phone. Believing they were talking to their own colleagues, some employees approved it. DFS later reported that four employees gave up their credentials in this way.²

The first accounts the attackers reached could not change user accounts. So they used them to learn how Twitter worked inside and who had the more powerful access, then went after those people next. By the morning of July 15 they had reached employees with access to the internal account tools, in the teams that handle legal requests and policy enforcement. More than 1,000 Twitter employees had access to those tools at the time.¹

July 15: from rare usernames to Barack Obama

The hackers did not go straight for the bitcoin scam. Their background was a scene that trades short, rare usernames, known as "OG" handles, for money. According to DFS, between about 3 a.m. and 10 a.m. Eastern time on July 15 they discussed in online chats which OG accounts to take over and sell for bitcoin. Some were sold or handed over that morning.¹

Just before 2 p.m. Eastern, hijacked OG accounts posted screenshots of Twitter's internal tool, which made it obvious to anyone paying attention that something was badly wrong. Then the attackers started using the access for money.

Source for the timeline: the DFS investigation report.¹

The scam posts were short and followed one template. A famous name said they wanted to give back to the community, everyone who sent bitcoin to the address would get double back, and the offer would only last 30 minutes. The deadline mattered. It pushed people to send before they had time to think, or to read the news that was starting to break.

How Twitter stopped it

Twitter's security team was already looking into the strange phone calls when the crypto accounts started posting. Removing the attackers took hours.¹ In the meantime the company did something it had never done before: it stopped many verified accounts from tweeting at all, and locked accounts whose passwords had been changed in the previous 30 days. For a while, news outlets, politicians and emergency services with a blue check could not post.

Afterwards Twitter cut back employee access to internal systems so sharply that ordinary account support slowed down. Every employee, the chief executive included, had to change their password on a video call while a supervisor watched.¹

How much money was taken

Different sources give slightly different numbers, because they counted at different times and not always the same addresses.

• The US Justice Department said the scam account received more than 400 transfers worth more than $100,000.⁵
• The New York regulator put consumer losses at "over $118,000".²
• Chainalysis, a blockchain analysis firm, counted 13.14 BTC (about $120,000 at the time) across the three addresses the scammers posted. bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh was the main one. Chainalysis also found that about $20,000 of the incoming money came from an address that likely belonged to the hackers themselves, a common trick to make an address look busy.⁴

It could have been much worse. Crypto exchanges including Coinbase, Gemini, Square and Bitstamp blocked their customers from sending money to the scam addresses that evening.² Coinbase said it stopped more than 1,000 transactions worth over $280,000.³ Within a week, Chainalysis watched part of the stolen bitcoin being moved through a mixing service to hide its trail.⁴

Bitcoin transactions cannot be reversed. Nobody who sent coins to the address that day is known to have got them back from it.

Who did it

On July 31, 2020, sixteen days after the attack, US authorities announced charges against three people:⁵

• Graham Ivan Clark, 17, of Tampa, Florida, described by Florida prosecutors as the leader. Because he was a minor, federal prosecutors handed his case to the Hillsborough County State Attorney, who charged him as an adult with 30 felony counts.
• Mason Sheppard, known online as "Chaewon", 19, of Bognor Regis in England, charged with conspiracy to commit wire fraud, conspiracy to commit money laundering and intentional access of a protected computer.
• Nima Fazeli, known as "Rolex", 22, of Orlando, Florida, charged with aiding and abetting intentional access of a protected computer.

In March 2021 Clark accepted a plea deal: three years in a juvenile facility followed by three years of probation, the maximum under Florida's youthful offender law, with a ban on using computers without permission and supervision from law enforcement. "Clark took over the accounts of famous people, but the money he stole came from regular hard working people," the Hillsborough State Attorney said.⁶

A fourth man, Joseph James O'Connor, known as "PlugwalkJoe", was arrested in Estepona, Spain, in July 2021 and later extradited to the United States.⁷ In May 2023 he pleaded guilty in New York to charges that included the Twitter hack, a separate SIM-swapping theft of cryptocurrency, the takeover of TikTok and Snapchat accounts, and cyberstalking. In court records he admitted, among other things, agreeing to pay $10,000 for access to one Twitter account.⁸ On June 23, 2023 he was sentenced to five years in federal prison and ordered to forfeit $794,000.⁹ In November 2025, prosecutors in the UK won a civil recovery order over 42.378 BTC plus other crypto linked to him, worth about £4.11 million at the time.¹⁰

We have not found a public record of how the cases against Sheppard and Fazeli ended, so we are not going to guess.

What regulators concluded

New York's Department of Financial Services published its investigation on October 14, 2020. Its findings were blunt. At the time of the attack Twitter had no chief information security officer, and its access controls, identity management and security monitoring were not good enough for a company of its size. The report pointed out that a few young people with phone calls had briefly controlled accounts that millions of people treat as a news source, and it called for the largest social media companies to be regulated as systemically important.²

Twitter hired a new chief information security officer in September 2020, added background checks for staff with access to sensitive user tools, moved employees onto hardware security keys and gave support staff training against social engineering.³

Why this address still matters

The scam lasted an afternoon, but the address did not go away. It still appears in old screenshots and news articles. It turns up in copied "giveaway" posts and videos that reuse the 2020 script with a new face, often a deepfake of the same celebrities. Anyone who searches for it should find a plain warning first, which is why this site exists.

There are a few lessons in the story that apply far beyond Twitter:

1. A famous name proves nothing. On July 15, 2020 the posts really did come from the official accounts of Obama, Musk and Apple. The accounts were genuine. The people typing were not.
2. "Send first, receive double" is always a scam. No real person or company runs a giveaway that starts with you sending money.
3. Urgency is a tool. The 30-minute deadline was there to stop people from checking.
4. Crypto payments are final. There is no bank to call and no chargeback. The only protection is not sending.
5. Nobody can "recover" your coins for a fee. After big scams, a second wave of fraudsters offers recovery services. They take a fee and disappear.

If you want to protect yourself, start with our guides on keeping your bitcoin safe and securing your X account.

Questions