On July 15, 2020, a seventeen-year-old in Tampa, Florida orchestrated the most visible hack in social media history. In a matter of hours, accounts belonging to Barack Obama, Joe Biden, Elon Musk, Bill Gates, Jeff Bezos, Apple, Uber, and over a hundred other high-profile targets posted a Bitcoin scam to their combined 350 million followers. The attack was not sophisticated in the technical sense - it relied on social engineering Twitter employees by phone. But it demonstrated that no level of account security protects a user if an attacker can convince an insider to bypass it.
The perpetrators were teenagers. Graham Ivan Clark, 17, was the ringleader, operating online as "Kirk." He was assisted by Mason Sheppard, 19, of the UK, and Nima Fazeli, 22, of Orlando. The attack was initially motivated by profit from the Bitcoin scam - which netted approximately $117,000, modest by cybercrime standards - but the group's real goal was acquiring high-value "OG" (original gangster) Twitter usernames to sell to collectors in the OGUsers community, where short, desirable handles like @drug or @l sold for thousands of dollars.
The Phone Phishing Attack
The initial access vector was a phone call. Clark or an associate called Twitter employees posing as a Twitter IT department employee, specifically targeting employees with access to the internal admin tools known colloquially as "God mode" - a customer support interface that allowed employees to view and modify nearly any aspect of a Twitter account.
The pretext was a COVID-19 VPN issue. The caller told targets that they needed to re-verify their credentials through an internal VPN tool to regain access, and directed them to a credential-harvesting website that mimicked Twitter's internal login pages. At least two Twitter employees provided their credentials. One of them had access to the admin tools.
The admin tools allowed the attacker to change the email address associated with any account - bypassing two-factor authentication entirely, since 2FA codes are sent to the registered email. Clark changed the email addresses for target accounts, then triggered password resets to gain full access. He also used the admin tools to disable the email-change notifications that would normally alert account holders.
The Hack Unfolds in Real Time
Clark began by taking over several accounts in the OGUsers community - short usernames that he could sell. He also acquired @dark and other sought-after handles. But the operation escalated when he decided to use the access for the Bitcoin scam.
At approximately 4:17 PM ET on July 15, the Twitter account for cryptocurrency exchange Binance posted a Bitcoin address with a promise to double any Bitcoin sent to it during the next 30 minutes. Then @Ripple, @Gemini, @CoinDesk. Then the celebrity accounts: Elon Musk (at the time, 35 million followers), then Kanye West, then Bill Gates, then Joe Biden, Jeff Bezos, Barack Obama, Apple, Uber, Warren Buffett.
The pattern was identical: a Bitcoin doubling scam, a wallet address, urgency. The Bitcoin address received over 400 transactions totaling roughly $117,000 before Twitter shut down the accounts' ability to tweet. In a panic, Twitter temporarily disabled the ability for all verified accounts to post - a blunt instrument that affected millions of accounts and made clear something had gone catastrophically wrong.
The Investigation and Arrests
The FBI, IRS Criminal Investigation, and Secret Service investigated jointly. The Bitcoin blockchain provided transparent transaction records, and chain analysis linked the wallet to exchange accounts. Clark's operational security failures were significant for someone who had pulled off the most visible hack in Twitter's history: he had moved some of the Bitcoin to a Coinbase account using identification documents, creating an irrefutable link between the Bitcoin and a real identity.
Clark was arrested on July 31, 2020, sixteen days after the hack. He was in Tampa. Sheppard was identified through his online aliases and cryptocurrency transactions. Fazeli was identified through records at cryptocurrency exchanges where he had tried to move proceeds.
The most consequential legal outcome was Clark's plea deal. Charged as a minor in Florida state court rather than federal court (a significant advantage), he pleaded guilty to 30 felony counts and was sentenced to three years in prison - a relatively lenient outcome given the scale of the hack. Sheppard received a sentence in the UK. Fazeli received probation.
The OGUsers Connection
The 2020 Twitter hack was the most public act of the "OG" username community - a subculture that had been operating for years trading rare social media handles, phone numbers, and email addresses. The OGUsers forum was where short, desirable usernames were bought and sold, and where SIM swapping skills were commodified into a services marketplace.
Clark's background was in SIM swapping - he had previously been investigated for stealing $856,000 in cryptocurrency via SIM swaps, charges he avoided when his victim declined to cooperate. The Twitter hack was in some ways an escalation of the same model: use social engineering or insider access to bypass 2FA and take over valuable accounts.
The OGUsers connection also led to a broader FBI investigation of the community that resulted in multiple additional arrests in 2021 and 2022. Clark himself had been a prominent member, and his cooperation with investigators - limited, per his lawyers - provided additional context about the community's operations.
What Changed at Twitter
Twitter's published post-incident response included: restricting access to internal account management tools during the incident and maintaining tighter access controls afterward, implementing multi-factor verification requirements for accessing sensitive tooling (requiring multiple employees to authorize actions on high-value accounts), enhanced monitoring of internal tool access, and changes to the internal IT helpdesk processes that had been exploited as the initial attack vector.
The hack also accelerated Twitter's existing work on Security Keys - hardware 2FA devices - for employee accounts, and specifically for employees with access to admin tooling. The social engineering attack against employee phone credential capture was made significantly harder if the credential being captured was a hardware key rather than a password.
The FTC investigated Twitter's security practices and in 2022 imposed a $150 million fine for related failures (primarily related to misuse of users' phone numbers for advertising rather than the 2020 hack specifically, but part of a broader settlement).