Twitter Hack: What Happened, and How to Protect Your Crypto

The phrase covers several different events, and headlines often blur them. Before reacting, work out which kind you are looking at.

• The July 2020 account hijacks. Attackers took over dozens of well-known accounts and posted a bitcoin giveaway scam. This is the incident most people mean.
• Data leaks. In late 2022 a report said more than 5.4 million user records, including phone numbers and email addresses, were offered on the dark web. In January 2023 there were reports of fears that around 200 million email addresses had been posted on a hacking forum.
• Password collections. Reports in 2020 recalled earlier claims that malware had gathered more than 32 million passwords for sale. Collections like this typically come from infected devices or reused credentials, not from a breach of the platform itself.
• Single-account takeovers. Media outlets, brands and crypto projects have had accounts hijacked many times. In 2013, for example, accounts tied to CBS News programs were compromised.

The distinction matters because the fix differs. A platform breach calls for changing passwords and watching for phishing. A hijacked project account calls for ignoring every link it posts until the owner confirms recovery. A leak of contact details calls for caution with messages sent to you.

The service was later rebranded as X, so current coverage may use either name. If you are reading a breaking headline, treat the first reports as provisional and wait for a statement from the company or the affected account owner.

On July 15, 2020, a wave of high-profile accounts began posting nearly identical messages. The posts said the owners were giving back to the community and promised that anyone who sent bitcoin to a given address would receive double in return. One report put the supposed donation at 5,000 BTC. Accounts belonging to cryptocurrency companies and well-known individuals were among those used.

Twitter described the event as a coordinated social engineering attack that targeted employees with access to internal systems and tools. Within a short time the company limited functions on many accounts, and some verified users could not tweet while it investigated.

A few days later the company said the attackers had targeted 130 accounts. For a smaller group it said they were able to take control and send tweets. For some accounts the attackers downloaded data, which included direct messages according to reports at the time.

The scam itself was crude: a giveaway that asks you to send crypto first. What made it effective was the source. People who would ignore the same message from a stranger gave it weight because it came from an account they trusted.

The incident became a reference point for platform security because it showed how little technical skill an attacker may need when internal tools are reachable by persuading staff.

The company said the attackers did not break in by exploiting a software flaw. They manipulated people. Later reporting said Twitter believed a targeted spear-phishing attack let hackers into its internal systems on July 15, and that this led to the compromise of accounts.

Social engineering follows a rough pattern:

1. Research. The attacker learns which employees have access to sensitive tools.
2. Pretext. They contact those staff by phone or message, posing as colleagues or IT support.
3. Credential capture. The target is steered to a fake login page or tricked into giving credentials and codes.
4. Internal access. With valid logins, the attacker uses real admin tools to reset or take over accounts.
5. Monetisation. The attacker posts the scam and collects incoming crypto.

Because steps three and four use legitimate credentials, standard defences that look for malware or exploits may not notice anything.

There are practical lessons for ordinary users as well. Support staff, exchange agents and project moderators are all targets for the same tactics. Anyone who contacts you first, claims urgency and asks for a code, a seed phrase or a wallet signature is following the same script. A real support team will not ask for your recovery phrase or a one-time code, however convincing the branding or the caller's tone.

A data leak is a different problem from a hijack. The reports in 2022 and 2023 described collections of user records, such as email addresses and phone numbers, being offered or posted online. These records link a public handle to private contact details.

That linking is the risk. Even without a password, an attacker holding your email or phone number can:

• Send phishing messages that mention your handle to look credible.
• Attempt SIM-swap attacks, in which they persuade a mobile carrier to move your number to their SIM and then intercept SMS codes.
• Try your email address on other services where you may reuse a password.
• Work out which anonymous accounts belong to a real person.

For crypto users who keep their identity separate from their wallets, this is the most important point. If a pseudonymous account was tied to an email address in a leak, assume someone can connect it to you.

Leaks reported from forums are sometimes compilations of older data, and the scale claimed by sellers is not always accurate. Treat headline numbers cautiously, and do not wait for confirmation before taking low-cost precautions. Check whether your email appears in a breach-notification service, change reused passwords, and move two-factor authentication away from SMS. Those steps cost little and protect you whether or not the claim holds up.

When you see a report, a few questions can tell you what kind of event it is.

Question	Platform breach	Single hijacked account
Who is affected?	Many unrelated users	One brand, project or person
What is exposed?	Contact details, data, internal access	That account's posts and followers
Who confirms it?	The company	The account owner, via another channel
What should you do?	Secure your own account	Ignore its links until recovery is confirmed

Signs an account has been taken over:

• A sudden giveaway, airdrop or "emergency migration" from an account that has never posted one.
• Replies are limited or filled with praise from new accounts.
• A link to a domain that is close to, but not exactly, the project's real site.
• A demand to connect a wallet or sign a message to claim something.
• Older posts deleted or the bio and banner altered.

Project teams usually confirm a hijack through a second channel, such as their website banner, a Discord announcement or a statement from a founder's separate account. If none of those mention the post, assume it is a scam.

The broader rule is that a platform's trust signals can be stolen along with the account. A badge, a follower count and years of post history all transfer to the attacker.

Hijacked accounts are used for a small number of repeating scams.

• Doubling giveaways. Send crypto to an address and receive more back. Nothing is ever returned.
• Fake airdrops and claims. A link leads to a site that asks you to connect a wallet and approve a transaction. The approval gives the attacker permission to spend your tokens.
• Wallet drainers. The site requests a signature that looks harmless, such as a login or permit message, but authorises the transfer of assets.
• Fake migrations or upgrades. The post says users must move funds to a new contract or site.
• Impersonation of known brands. Scammers copy the names and styles of established protocols such as Uniswap, Lido and Aave, or of exchanges such as OKX, because users already expect to interact with them.

None of these protocols or exchanges runs giveaways that require you to send assets first. If a post claims otherwise, open the service yourself by typing its address from a saved bookmark and look for the announcement there.

When reading any transaction prompt, check what it asks for. A request to approve unlimited spending, to sign a message you cannot read, or to move assets to an unfamiliar address is a stop sign. Small test transactions from a separate wallet that holds little value reduce the damage if you misjudge one.

If you interacted with a suspicious post, act in this order and do not delay.

1. Stop interacting. Do not click further or sign anything else.
2. Move assets first. If you connected or signed with a wallet, create a new wallet on a clean device and transfer remaining funds there. Use a fresh seed phrase, not the old one.
3. Revoke approvals. On the old wallet, use a token-approval checker to remove permissions granted to unknown contracts. Do this only after your assets are safe, and keep a little native token for gas.
4. Scan your device. If you entered a seed phrase anywhere, treat that wallet as permanently compromised. If you downloaded a file, run a security scan.
5. Secure linked accounts. Change the passwords for email, exchanges and social accounts, and enable app-based or hardware two-factor authentication.
6. Record evidence. Save the post, the address and any transaction hashes.
7. Report. Tell the platform, your exchange if funds went to one, and your local authorities. Expect that recovery is unlikely, since sent crypto is generally irreversible.

Be suspicious of anyone who contacts you offering to recover stolen funds for a fee. Recovery scams target victims of earlier scams, and genuine help never asks for your seed phrase or an upfront payment.

You cannot control how a platform protects its internal tools, but you can reduce the damage if your own account is targeted.

• Use a hardware security key or an authenticator app for two-factor authentication. Avoid SMS codes, which can be intercepted by SIM-swap attacks.
• Use a unique, long password from a password manager. Reused passwords are how credential collections do damage.
• Protect your email account most of all, since it can reset everything else. Give it a separate password and the strongest two-factor option available.
• Add a carrier PIN or port-out lock to your mobile number if your carrier offers one.
• Review connected apps in your account settings and remove any you do not use.
• Do not log in through links in messages. Type the address or use a saved bookmark.

For project teams and anyone who manages a community account:

• Limit how many people hold login access, and use a shared password manager rather than sharing passwords in chat.
• Agree on a second channel for confirming any urgent announcement.
• Pin a notice telling followers that the team never runs giveaways that ask for funds.

Keep your serious holdings in a wallet that you never connect to unfamiliar sites. A separate low-balance wallet for experiments and claims keeps one mistake from emptying everything.

A new report can be hard to judge in the first hours. These checks help.

1. Find the date. Many public reporting are old. The headlines about the 2020 bitcoin scam, the 2022 records and the 2023 emails continue to circulate and can be mistaken for something new.
2. Look for the primary statement. The company's own security update, or the affected owner's confirmation, outranks commentary.
3. Separate claims from confirmation. Phrases such as "reportedly" or "fears that" mean the number or scope is unverified.
4. Check the scale claimed. Compare it with earlier reports. Sellers of stolen data often inflate or recycle old material.
5. Do not click posts about the event. Scammers use breaking news to push fake "check if you are affected" tools and fake compensation claims.
6. Act on the safe defaults. Update your password, enable stronger two-factor authentication and review connected apps whether or not the report is confirmed.

As far as the results here show, the 2020 incident was resolved as a past event, and the later leaks were reported as data circulating online, not as an ongoing takeover of accounts. For anything current, rely on the company's security communications and on the project that appears to be affected.

The constant across all of these incidents is that attackers use trust, whether in an employee, a verified badge or a famous name. Verifying through a second channel before you send funds or sign anything removes most of their advantage.