Last week, the US Department of Justice (DOJ) charged three men for their alleged roles in one of the largest Twitter breaches in history, which led to the hijacking of 130 high-profile accounts of politicians, celebrities and musicians.
According to a Florida affidavit, two Florida residents and one UK national were responsible for the hack, and are now charged with conspiracy to commit wire fraud, conspiracy to commit money laundering, and the intentional access of a protected computer.
The trio, who remained a mystery until the recent announcement, allegedly managed to defraud over 400 individuals through a clever bitcoin scam by piggybacking compromised Twitter VIP accounts.
“I am giving back to my community due to Covid-19. All Bitcoin sent to my address below will be sent back double. If you send $1,000, I will send back $2,000,” read one of the fraudulent tweets.
“The Twitter attack consisted of a combination of technical breaches and social engineering,” the reports said. “The hackers are alleged to have created a scam bitcoin account, to have hacked into Twitter VIP accounts, to have sent solicitations from the Twitter VIP accounts with a false promise to double any bitcoin deposits made to the scam account, and then to have stolen the bitcoin that victims deposited into the scam account. “
Posing as prominent social media figures, the bad actors gained over $100,000 in Bitcoin transactions from victims. Although the scheme was successful at first, the men made little attempt to conceal their identities, using their home IP addresses and driver’s license to verify Bitcoin wallets.
“Upon opening an investigation into this attack, our investigators worked quickly to determine who was responsible and to locate those individuals,” said San Francisco FBI Special Agent in Charge John F. Bennett. “While investigations into cyber breaches can sometimes take years, our investigators were able to bring these hackers into custody in a matter of weeks.”
The hackers allegedly compromised over 100 social media accounts and scammed both the account users and others who sent money based on their fraudulent solicitations,” said Acting Assistant Attorney General Brian C. Rabbitt of the Justice Department’s Criminal Division. “The rapid investigation of this conduct is a testament to the expertise of our investigators, our commitment to responding quickly to cyber attacks, and the close relationships we have built with law enforcement partners throughout the world.”