Obama, Kim Kardashian, Apple, Biden, Musk and other high-profile Twitter accounts hacked in crypto scam

A number of high-profile Twitter accounts were simultaneously hacked on Wednesday by attackers who used the accounts — some with millions of followers — to spread a cryptocurrency scam.

Apple, Elon Musk and Joe Biden were among the accounts compromised in a broadly targeted hack that remained mysterious hours after taking place. Those accounts and many others posted a message promoting the address of a bitcoin wallet with the claim that the amount of any payments made to the address would be doubled and sent back — a known cryptocurrency scam technique.

In the hours following the initial scam posts, Kim Kardashian West, Jeff Bezos, Bill Gates, Barack Obama, Wiz Khalifa, Warren Buffett, YouTuber MrBeast, Wendy’s, Uber, CashApp and Mike Bloomberg also posted the cryptocurrency scam.

While we’re still learning more specifics about how the hack went down, we can report that the hacker leveraged an internal Twitter admin tool to gain access to the high-profile accounts. That reporting was soon confirmed by Twitter’s own account of what happened. On Wednesday evening, the company tweeted that “a coordinated social engineering attack” on employees gave a hacker “access to internal systems and tools.”

Before the scope of the incident became clear, the hack appeared to focus on cryptocurrency-focused accounts. In an initial wave of scam posts, @bitcoin, @ripple, @coindesk, @coinbase and @binance were hacked with the same message: “We have partnered with CryptoForHealth and are giving back 5000 BTC to the community,” followed by a link to a website.

The linked site was quickly pulled offline. Kristaps Ronka, chief executive of Namesilo, the domain registrar used by the scammers, told TechCrunch that the company suspended the domain “on the first report” it received. Hacked accounts shifted to sharing multiple bitcoin wallet addresses as the incident went on, making things more difficult to track.

Twitter first acknowledged the situation at 2:45 p.m. PT Wednesday afternoon, referring to it as a “security incident.”

At first, it appeared that some of the compromised accounts were back under their owners’ control as tweets were quickly deleted. But then, Elon Musk’s account tweeted “hi” after his initial tweet with the scam was deleted. The “hi” tweet also disappeared. 

Twitter users reported seeing error messages on the platform as the situation went on. TechCrunch reporter Natasha Mascarenhas saw this error (see below) when she tried to create a threaded tweet. TechCrunch reporter Sarah Perez saw a similar error when trying to post a normal tweet. Both have verified accounts.

As the issues continued, many verified Twitter users also reported being unable to tweet. Around 3:15 p.m. PT, the official Twitter Support account confirmed “[Users] may be unable to Tweet or reset your password while we review and address this incident.” By Wednesday evening, Twitter said that most tweeting should be back to normal but functionality “may come and go” as the company “continue[s] working on a fix.”

Who was hacked
It became clear early on that this situation was not the case of a single account being compromised as we’ve seen in the past, but something else altogether. Even Apple, a company known for robust security, somehow fell victim to the scheme.

Apple’s account was also hacked. This was the account’s first tweet. (Image: TechCrunch)

Many high profile accounts were quickly hijacked in rapid succession Wednesday afternoon, including @elonmusk, the eccentric Twitter-obsessed tech figure with a notoriously engaged fanbase. A scam tweet posted to the Tesla and SpaceX founder’s account simply directed users to send bitcoin to a certain address under the guise that he will “double any payment” — a known cryptocurrency scam technique. Musk’s account appeared to remain compromised for some time after the initial message, with follow-up posts claiming followers were sending money to the suspicious address.

Some Democratic political figures were also hacked as part of the cryptocurrency scam, including Barack Obama, Joe Biden and Mike Bloomberg. An official from the Biden campaign told TechCrunch that Twitter locked down the former vice president’s account “immediately” after it was compromised and the campaign remains in close contact with Twitter on the issue. At the time of writing, no accounts belonging to Republican politicians appear to have been hacked.

 

Wiz Khalifa’s account was also compromised, as was the Twitter account of popular YouTuber MrBeast, who often posts giveaways, making his re-post of the bitcoin address particularly likely to drive followers to the scam.

The hack also hit legendary investor Warren Buffet, a prominent and harsh critic of cryptocurrencies like bitcoin. “I don’t have any cryptocurrency and I never will,” Buffet told CNBC in February.