Why the Twitter Bitcoin hack fell flat

The Twitter hack says a lot about decentralisation, so it's only appropriate that it was squandered on crypto scams.

This week Twitter succumbed to a potentially world changing security breach when hackers are believed to have gained access to the social media platform's employee panel. According to Twitter, the hackers are believed to have used "a coordinated social engineering attack" to target the key-carrying employees.

So armed with the keys to the castle, these hackers took over many of the world's most prominent Twitter accounts, including Bill Gates, Barrack Obama, Joe Biden, Michael Bloomberg, Elon Musk, Warren Buffet, Apple and many figures from the crypto space, and started to tweet.

For a few hours these hackers held an unimaginable amount of power. They could have, for example, tweeted "Initiate coronavirus phase 2" from Bill Gates' Twitter account while Obama, Biden and Hillary Clinton simultaneously tweet "Hail Hydra @BillGates".

Instead, they managed to barely muster up an unimpressive and generic Bitcoin scam, basically just tweeting out variations of "send Bitcoin to this address" from whoever had a lot of followers.

As it rolled out, Bitcoin started trending again, mostly on Twitter but also to an extent as a Google search.

"Bitcoin" – Google Trends

The hackers accomplished nothing short of, and not much more than, briefly ushering in a new golden age for the "Bitcoin twitter scam" search term.

"Bitcoin Twitter scam" – Google Trends

And that's about it.

Bitcoin prices did not discernibly respond and the entire spectacle netted maybe US$100,000 worth of Bitcoin for the hacker scammer. The FBI is now reportedly investigating the matter, with leads in the form of a domain registration for one of the sites associated with the scam and the wonderfully public and fully transparent Bitcoin addresses themselves.

The perpetrator(s) could do anything, and with the barest ingenuity, they could have made much more money, caused much more havoc or had much bigger laughs. Instead, they just flopped.

The white bread nature of the incident spurred a lot of discussion around the perpetrator's motives.

Motives

One initially trendy line of thinking was that they obviously weren't after money, given how ineffective the scam ended up being. $100,000 is a nice payday – assuming they can ever spend it, which is looking doubtful – but netting that amount from these circumstances is a bit like wishing for a foot rub from a genie.

Some suggested that it was more about entertainment than money, or more about sending a message. Some said it was an attempt to advertise crypto, others said it was about making crypto look bad but everyone can agree that it's had practically zero impact one way or another on that front.

Others floated the idea that it was all a distraction to cover up something more nefarious elsewhere. Maybe the masterminds went after private direct messages and then just used a sloppy crypto scam to cover their tracks?

It's too soon to say for sure, but the most likely explanation is probably that it was just an attempted cash grab which fell flat due to the perpetrator's inexperience and lack of creativity. There are a few reasons to assume this.

Firstly, because that particular type of Twitter Bitcoin scam is tried and tested, and if someone's suddenly found themselves with this kind of window of opportunity there's a chance they'll just go back to the basics. Secondly, because if this did involve simply buying access from a disgruntled Twitter employee or some such, no particular amount of technical capability or ingenuity was really needed.

Plus, the scammer made a beeline for the crypto-related Twitter accounts and only moved on more widely after those started drying up. If it was just meant to be a distraction of sorts, why start with crypto? And if the goal was something other than money, why not be a bit more subtle? The victims wouldn't necessarily have even realised someone was accessing their accounts if they didn't suddenly find themselves tweeting out crypto scams.

The perpetrator's own wallet management was also kind of sloppy, according to people who get really judgmental about blockchain usage.

Yesterday I thought the guy who hacked Twitter accounts was a genius and had some ulterior motive than just stealing a few BTC. Today I'm pretty sure the hacker is actually an idiot who is in way too deep. Sloppy wallet management, weak mixing attempts, and exchange associations.

— Larry Cermak (@lawmaster) July 16, 2020

That's as good a reason as any to use privacy coins for your criminal activities. If you don't, you'll have to get used to a lot of people commenting on your public performance.

The scammers here may have felt that, because they supposedly started cycling Bitcoin through their own wallets in an attempt to create the illusion that the scam was working better than it really was.

Consequences

The initial consequences of the event were pretty much nonexistent, except for the handful of people who fell for the scam and any momentary embarrassment people may have incurred by having their account used to tweet scams.

One of the reasons is probably because the scam itself is so stale now.

As is typical for these types of scams, most of the funds sent to the scammers' wallets in this case came directly from exchanges which suggests that it was basically a handful of inexperienced crypto users falling for it. That's one of the problems with it. The target audience consists of that very narrow overlap between people who own cryptocurrency, people who are naive enough to fall for this kind of scam and people who haven't already learned their lesson by falling for it once.

That's also one of the potential reasons the market impacts of this scam were negligible.

For a brief moment, someone could put words in the mouths of world leaders, making it one of the most potentially catastrophic hacks the world has ever seen, and instead, they chose to try to pull off a cliche scam that everyone was inured to years ago.

The long term results might be bigger though. As we've seen here, backdoors can let practically anyone into even the most sensitive systems, creating some unacceptable vulnerabilities. These kinds of incidents are precisely why every cybersecurity-type person unanimously agrees that backdoors are bad ideas which add more risks than they remove.

If nothing else, the incident presented a strong argument in favour of decentralised design and some of the merits of blockchain technology. So it's really only appropriate that it was squandered on a quick cash grab made from cheating people with digital play money.

Also watch

Disclosure: The author holds KDA, ETH, BNB, BTC at the time of writing.

Picture: Shutterstock