A Twitter hacking scheme that targeted political, corporate and cultural elites this week began with a teasing message between two hackers late Tuesday on online messaging platform Discord.
"yoo bro," wrote a user named "Kirk," according to a screenshot of the conversation shared with The New York Times. "i work at twitter / don't show this to anyone / seriously."
He then demonstrated that he could take control of valuable Twitter accounts — the sort of thing that would require insider access to the company's computer network.
The hacker who received the message, using the screen name "lol," decided over the next 24 hours that Kirk did not actually work for Twitter because he was too willing to damage the company. But Kirk did have access to Twitter's most sensitive tools, which allowed him to take control of almost any Twitter account, including those of former President Barack Obama, former Vice President Joe Biden, Elon Musk and many other celebrities.
READ MORE: • Kanye West and Elon Musk's Twitter accounts hacked in bitcoin scam targeting celebrities
Despite global attention on the intrusion, which has shaken confidence in Twitter and the security provided by other technology companies, the basic details of who were the people responsible, and how they did it, have been a mystery. Officials are still in the early stages of their investigation.
But four people who participated in the scheme spoke with The Times and shared numerous logs and screenshots of the conversations they had Tuesday and Wednesday, demonstrating their involvement both before and after the hack became public.
The interviews indicate that the attack was not the work of a single country like Russia or a sophisticated group of hackers. Instead, it was done by a group of young people — one of whom says he lives at home with his mother — who got to know one another because of their obsession with owning early or unusual screen names, particularly one letter or number, like @y or @6.
The Times verified that the four people were connected to the hack by matching their social media and cryptocurrency accounts to accounts that were involved with the events Wednesday. They also presented corroborating evidence of their involvement, like the logs from their conversations on Discord, a messaging platform popular with gamers and hackers, and Twitter.
Playing a central role in the attack was Kirk, who was taking money in and out of the same Bitcoin address as the day went on, according to an analysis of the bitcoin transactions by The Times, with assistance from research firm Chainalysis.
But the identity of Kirk, his motivation and whether he shared his access to Twitter with anyone else remain a mystery even to the people who worked with him. It is still unclear how much Kirk used his access to the accounts of people like Biden and Musk to gain more privileged information, like their private conversations on Twitter.
The hacker "lol" and another one he worked with, who went by the screen name "ever so anxious," told The Times that they wanted to talk about their work with Kirk in order to prove that they had only facilitated the purchases and takeovers of lesser-known Twitter addresses early in the day. They said they had not continued to work with Kirk once he began more high-profile attacks around 3:30 p.m. Eastern time Wednesday.
"I just wanted to tell you my story because i think you might be able to clear some thing up about me and ever so anxious," "lol" said in a chat on Discord, where he shared all the logs of his conversation with Kirk and proved his ownership of the cryptocurrency accounts he used to transact with Kirk.
"lol" did not confirm his real-world identity but said he lived on the West Coast and was in his 20s. "ever so anxious" said he was 19 and lived in the south of England with his mother.
Investigators looking into the attacks said several of the details given by the hackers lined up with what they had learned, including Kirk's involvement both in the big hacks later in the day and the lower-profile attacks early Wednesday.
The Times was initially put in touch with the hackers by a security researcher in California, Haseeb Awan, who was communicating with them because, he said, a number of them had previously targeted him and a Bitcoin-related company he once owned. They also unsuccessfully targeted his current company, Efani, a secure phone provider.
The user known as Kirk did not have much of a reputation in hacker circles before Wednesday. His profile on Discord had been created only July 7.
But "lol" and "ever so anxious" were well known on the website OGusers.com, where hackers have met for years to buy and sell valuable social media screen names, security experts said.
For online gamers, Twitter users and hackers, so-called OG usernames — usually a short word or even a number — are hotly desired. These eye-catching handles are often snapped up by early adopters of a new online platform, the "original gangsters" of a fresh app.
Users who arrive on the platform later often crave the credibility of an OG username and will pay thousands of dollars to hackers who steal them from their original owners.
Kirk connected with "lol" late Tuesday and then "ever so anxious" on Discord early Wednesday, and asked if they wanted to be his middlemen, selling Twitter accounts to the online underworld where they were known. They would take a cut from each transaction.
In one of the first transactions, "lol" brokered a deal for someone who was willing to pay $1,500, in bitcoins, for the Twitter user name @y. The money went to the same bitcoin wallet that Kirk used later in the day when he got payments from hacking the Twitter accounts of celebrities, the public ledger of bitcoin transactions shows.
The group posted an ad on OGusers.com, offering Twitter handles in exchange for bitcoins. "ever so anxious" took the screen name @anxious, which he had long coveted. (His personalized details still sit atop the suspended account.)
"i just kinda found it cool having a username that other people would want," "ever so anxious" said in a chat with The Times.
As the morning went on, customers poured in, and the prices that Kirk demanded went up. He also demonstrated how much access he had to Twitter's systems. He was able to quickly change the most fundamental security settings on any username and sent out pictures of Twitter's internal dashboards as proof that he had taken control of the requested accounts.
The group handed over @dark, @w, @l, @50 and @vague, among many others.
One of their customers was another well-known figure among hackers dealing in usernames — a young man known as "PlugWalkJoe." On Thursday, PlugWalkJoe was the subject of an article by security journalist Brian Krebs, who identified the hacker as a key player in the Twitter intrusion.
Discord logs show that while PlugWalkJoe acquired the Twitter account @6 through "ever so anxious," and briefly personalized it, he was not otherwise involved in the conversation. PlugWalkJoe, who said his real name is Joseph O'Connor, added in an interview with The Times that he had been getting a massage near his current home in Spain as the events occurred.
"I don't care," said O'Connor, who said he was 21 and British. "They can come arrest me. I would laugh at them. I haven't done anything."
O'Connor said other hackers had informed him that Kirk got access to the Twitter credentials when he found a way into Twitter's internal Slack messaging channel and saw them posted there, along with a service that gave him access to the company's servers. People investigating the case said that was consistent with what they had learned. A Twitter spokesman declined to comment, citing the active investigation.
All of the transactions involving "lol" and "ever so anxious" took place before the world knew what was going on. But shortly before 3:30 p.m., tweets from the biggest cryptocurrency companies, like Coinbase, started asking for bitcoin donations to the site cryptoforhealth.com.
"we just hit cb," an abbreviation for Coinbase, Kirk wrote to "lol" on Discord a minute after taking over the company's Twitter account.
The public ledger of bitcoin transactions shows that the bitcoin wallet that paid to set up cryptoforhealth.com was the wallet that Kirk had been using all morning, according to three investigators, who said they could not speak on the record because of the open investigation.
In several messages Wednesday morning, "ever so anxious" talked about his need to get some sleep, given that it was later in the day in England. Shortly before the big hacks began, he sent a phone message to his girlfriend saying, "nap time nap time," and he disappeared from the Discord logs.
Kirk quickly escalated his efforts, posting a message from accounts belonging to celebrities like Kanye West and tech titans like Jeff Bezos: Send bitcoin to a specific account and your money will be sent back, doubled.
Shortly after 6 p.m., Twitter seemed to catch up with the attacker, and the messages stopped. But the company had to turn off access for broad swaths of users, and days later the company is still piecing together what happened.
When "ever so anxious" woke up just after 2:30 a.m. in Britain, he looked online, saw what had happened and sent a disappointed message to his fellow middleman, "lol."
"i'm not sad more just annoyed. i mean he only made 20 btc," he said, referring to Kirk's bitcoin profits from the scam, which translated to about $180,000.
Kirk, whoever he was, had stopped responding to his middlemen and had disappeared.
Written by: Nathaniel Popper and Kate Conger
Photographs by: Jim Wilson
© 2020 THE NEW YORK TIMES
