Level B2

The 17-Year-Old Who Hacked Twitter

How a Few Phone Calls Opened Twitter's Doors

In July 2020 a seventeen-year-old from Florida took over the Twitter accounts of Barack Obama, Elon Musk and Apple with a few phone calls and a fake login page. Olivia tells Sean how the bitcoin scam worked and how investigators followed the money.

↓ Download the printable PDF

Key words

These words appear in the episode. In the transcript, hover over or tap a highlighted word to see what it means.

regulatornoun

An official organisation that controls an industry and makes sure companies follow the rules.

The energy regulator fined the company for sending thousands of customers the wrong bills.

investigateverb

To examine a situation carefully in order to find out the truth.

The school is investigating how the exam questions appeared online the night before the test.

suspiciousadjective

Making you feel that something is wrong or dishonest.

I deleted the email straight away because the link looked suspicious.

believableadjective

Seeming real or likely, so people accept it as true.

Her excuse for being late was so believable that the manager apologised to her.

fall forphrasal verb

To be tricked into believing something that is untrue.

My brother fell for the fake parking ticket we left on his windscreen.

dead endnoun

A plan or path that leads nowhere and gives you no result.

The job sounded exciting at first, but it turned out to be a dead end.

status symbolnoun

Something people own to show others that they are rich or important.

In my grandfather's village, a car with leather seats was a real status symbol.

middlemannoun

A person who connects a buyer and a seller and usually keeps some of the money.

We bought the sofa directly from the factory, so we didn't have to pay a middleman.

trustworthyadjective

Honest and reliable, so you can depend on them.

Leave your spare keys with Maria, because she's the most trustworthy person in our building.

show offphrasal verb

To try to make people admire what you have or what you can do.

He kept showing off his new watch during the whole dinner.

scamnoun

A dishonest plan to get money from people.

The text message about a free holiday in Greece was obviously a scam.

bragverb

To talk too proudly about something you have done or something you own.

Tom bragged about his marathon time until everyone at the table got bored.

plead guiltyphrase

To say officially in court that you committed the crime.

The driver pleaded guilty to speeding and paid a large fine.

bailnoun

Money paid to a court so that an accused person can wait for the trial at home.

His parents paid his bail, so he could spend the weekend at home before the trial.

probationnoun

A period when someone who broke the law stays out of prison but must follow strict rules.

He is still on probation, so he isn't allowed to leave the country.

Did you understand?

Choose the correct answer.

1. Who sent the message "I work at Twitter" on Discord?

2. How did the hackers get inside Twitter?

3. What did Kirk do first with his new access?

4. Why did the scam make only about a hundred and eighteen thousand dollars?

5. How did investigators find out the real names of the British man and the man in Orlando?

Exercise 1

Odd one out

Which word doesn't belong? Think about why.

Exercise 2

Crossword

All the answers are key words from the episode.

Across

3 Personal details about the employees made the callers sound this. (10)
5 "Send me one bitcoin and I'll send you two" was one of these. (4)
6 Clark got three years of this after his three years in prison. (9)
7 Sean's sarcastic word for middlemen called "lol" and "ever so anxious". (11)
8 What detectives and journalists do after a crime. (11)

Down

1 For the teenager, it was set at $725,000. His lawyer said this was no problem. (4)
2 The New York State one looked into the hack and wrote a long report about it. (9)
4 Sean thinks hackers always get caught because they can't stop doing this online. (4)
5 Some Twitter employees reported the strange phone calls as this. (10)

Exercise 3

Your turn

A stranger phones you and says he works for your bank. He needs your card number to fix a problem with your account. What do you do? Write three or four sentences. Use at least two words from the list.

Your text is saved on this device.

At first the call might sound believable, because he knows my name and my address. Then he asks for my card number, and I start to feel suspicious. I would hang up and call my bank on the number printed on my card. I don't want to fall for a scam, even if the caller is extremely polite.

Full transcript

Show the transcript

Olivia

Late on a Tuesday night in July 2020, a hacker sends a message on Discord. "Yoo bro. I work at Twitter. Don't show this to anyone. Seriously."

Sean

And did he? Work at Twitter?

Olivia

He was seventeen, and he lived in Tampa, Florida.

Sean

So that's a no.

Olivia

That's a no. But by the next evening, he was tweeting as Barack Obama.

Sean

This is Aprendos English, level B2. I'm Sean.

Olivia

And I'm Olivia.

Sean

I remember this one. Obama, Elon Musk and Bill Gates all offered to double your bitcoin on the same afternoon.

Olivia

And Apple, and Uber, and Joe Biden, who was running for president at the time.

Sean

I always assumed it was some big criminal gang, possibly paid by a government. Russia, maybe?

Olivia

That's what a lot of people thought that evening. In fact, it was a small group of young guys who mostly knew each other from online forums.

Sean

So how does a teenager get inside one of the biggest tech companies in the world?

Olivia

With a phone. The New York State financial the whole thing afterwards, and their report says there was no malware at all.

Sean

Just a phone call?

Olivia

Several phone calls, actually. On the afternoon of July the fourteenth, one or more of the hackers started ringing Twitter employees at home.

Sean

At home, because of the pandemic.

Olivia

Exactly. Twitter had sent everybody home in March, so the whole company was connecting through a VPN, a kind of secure tunnel…

Sean

…which I imagine kept breaking.

Olivia

All the time, according to the report. So the hackers claimed to be the IT help desk, calling about a reported problem with the employee's VPN.

Sean

Which was probably true.

Olivia

Very likely! Then they sent the employee to a fake website that looked exactly like Twitter's real VPN login page.

Sean

But surely Twitter had two-factor authentication. You type your password, and then your phone asks you to confirm it's really you.

Olivia

They did. But while the employee was typing their password into the fake page, the hackers were typing it into the real one.

Sean

Oh, that's clever. So the employee's phone buzzes…

Olivia

…and they tap "yes, it's me," because they think they're just logging in.

Sean

So they've opened the door themselves.

Olivia

The callers also knew personal details about the employees, which made them sound . Some employees reported the calls as , but at least one didn't.

Sean

My mum would have that in about four seconds. She keeps all her passwords in a notebook next to the kettle, with a label on the front that says "Passwords."

Olivia

Sean, that's the first place a burglar would look.

Sean

I've told her that. She says burglars don't read.

Olivia

Okay, so they're inside, but the first employee they fooled couldn't actually take over accounts.

Sean

So it was a ?

Olivia

Not quite. They used that access to explore Twitter's internal websites, which explained how the other tools worked. So on July the fifteenth, they went after the people who had the powerful tools.

Sean

How many people had those tools?

Olivia

Guess.

Sean

Ten? Maybe twenty senior…

Olivia

…over a thousand, according to the regulator.

Sean

A thousand people could take over any account on Twitter?

Olivia

More or less. With those tools you could change the email address linked to an account, and then reset the password.

Sean

That's rather a lot of spare keys for one house.

Olivia

And the company didn't even have a head of security at the time, because the last one had left seven months earlier.

Sean

Right. So, a teenager with the keys to Twitter. He goes straight for Elon Musk, surely.

Olivia

You'd think so, but he actually went shopping for usernames first.

Sean

Usernames?

Olivia

Have you heard of OG handles? OG stands for "original gangster." They're very short Twitter names, just one letter or one number, like the letter y or the number six.

Sean

And people pay money for those?

Olivia

Thousands of dollars. Early users grabbed them in Twitter's first years, and people who arrived later want them as a . There's even a forum called OGUsers, where people buy and sell them.

Sean

I'm sorry, but I don't understand that at all.

Olivia

You're the man who owns a cricket bat signed by people you've never met.

Sean

That's history, Olivia. A single letter on the internet is hardly the same thing.

Olivia

It is to them. So Kirk, the name our teenager used on Discord, needed people who could sell the handles for him…

Sean

….

Olivia

Middlemen. Two guys who called themselves "lol" and "ever so anxious."

Sean

Brilliant names. Very .

Olivia

Extremely. According to the New York Times, one of the first deals was the handle y. It went for fifteen hundred dollars in bitcoin.

Sean

For the letter y.

Olivia

For the letter y. And "ever so anxious" took the handle "anxious" for himself, because he'd wanted it for years.

Sean

So these two actually believed that Kirk worked at Twitter?

Olivia

Not for long. Within about a day, "lol" decided Kirk couldn't possibly be an employee, because he was far too happy to damage the company.

Sean

Fair point, actually. A real employee would at least worry about his pension.

Olivia

By the afternoon, though, Kirk seemed bored of selling letters. Just before two o'clock, some of the stolen accounts started tweeting screenshots of Twitter's secret internal tools.

Sean

He was .

Olivia

He was totally showing off, and then at around quarter past two the bitcoin began.

Sean

I bet it was Musk first, because he's the obvious one.

Olivia

Wrong again. They started with a cryptocurrency trader, then moved on to big crypto companies like Binance and Coinbase.

Sean

Why start with the smaller accounts?

Olivia

Nobody knows for sure. Maybe it was a test, or maybe they thought crypto fans would be the easiest people to convince. One message from Kirk that afternoon just says, "we just hit cb."

Sean

CB for Coinbase, I assume.

Olivia

Yep. And a little after four o'clock, the famous names started falling. Musk, Gates, Kanye West and Warren Buffett all went within about two hours…

Sean

…and Obama.

Olivia

And Obama. Biden's tweet said, "I am giving back to the community. All Bitcoin sent to the address below will be sent back doubled!"

Sean

That's it?

Olivia

Then, "If you send a thousand dollars, I will send back two thousand. Only doing this for thirty minutes."

Sean

Only thirty minutes, so you don't have time to think.

Olivia

Which is the oldest trick in the book. Apple's account said something similar, that the company supported Bitcoin and would double everything people sent.

Sean

Apple, of all companies. They won't even give you a phone charger in the box these days.

Olivia

Doubling your money is apparently easier.

Sean

Hang on. What was Twitter doing while all this was happening?

Olivia

Their security team had been looking into strange phone calls since that morning. Once the crypto accounts started falling, however, it took them hours to throw the hackers out.

Sean

Hours? For a company that size?

Olivia

Their first public statement didn't come until about quarter to six in the evening. And then they did something quite dramatic…

Sean

…oh, I remember this, actually. They stopped verified accounts from tweeting, didn't they?

Olivia

That's right, and loads of blue tick accounts suddenly couldn't post anything at all.

Sean

Which caused its own problems. The National Weather Service in the US couldn't tweet a tornado warning that evening.

Olivia

Wait, seriously?

Sean

Seriously. And there's another detail I love about Twitter's own staff. According to the report, every employee had to change their password on a video call while a supervisor watched them.

Olivia

Every single employee?

Sean

Starting with the boss, Jack Dorsey. Imagine being the CEO while your supervisor watches you type "password one two three."

Olivia

I refuse to believe Jack Dorsey's password was password one two three.

Sean

We'll never know. So, the big question. How much money did Kirk make?

Olivia

You tell me.

Sean

Millions, surely. Obama alone had over a hundred million followers.

Olivia

About a hundred and eighteen thousand dollars, according to the regulator. Prosecutors in Florida said a hundred and seventeen thousand, and one early report put it at over a hundred and eighty.

Sean

That's all? With access to half the famous people on the planet?

Olivia

The crypto exchanges blocked the scam addresses very quickly. Coinbase alone stopped more than five thousand transfers, worth about one point three million dollars.

Sean

So they stopped more than ten times what was actually stolen.

Olivia

Exactly. Although plenty of people still paid. The Justice Department said the scam wallet received more than four hundred transfers.

Sean

Four hundred payments from people who believed Bill Gates was giving away money on a Wednesday afternoon.

Olivia

My grandmother nearly fell for something like that. A man rang her pretending to be her bank, and he was so polite that she nearly read him her card number. She only stopped because she couldn't find her glasses.

Sean

Saved by bad eyesight.

Olivia

She's very proud of it. Okay, so a hundred and thirty accounts were attacked in total, and forty-five were used to send tweets. The hackers also got into the private messages of up to thirty-six accounts.

Sean

Whose messages? Please don't say Obama's.

Olivia

Twitter said only one elected politician had their private messages read, a Dutch MP called Geert Wilders.

Sean

And the American president? Trump was in the White House at the time.

Olivia

His account wasn't touched. The Verge suggested his account had extra protection, but that's never been fully explained.

Sean

So, how did they catch them? Because I thought bitcoin was completely anonymous.

Olivia

Everyone thinks that. Can you guess?

Sean

Somebody about it online. It's always the bragging with these people.

Olivia

Partly right, because some of the hackers actually gave interviews to the New York Times two days later…

Sean

…you're joking.

Olivia

I'm not. But the real problem for them was the money itself.

Sean

Oh, this is where I come in, actually. I read the Justice Department's press release about this.

Olivia

Be my guest.

Sean

Every bitcoin payment is recorded on a public list called the blockchain, so anyone can follow the money from wallet to wallet. Tax investigators from the IRS did exactly that, with help from a company called Chainalysis. Eventually the money reached ordinary crypto exchanges, like Coinbase and Binance…

Olivia

…and those exchanges want to know who you are.

Sean

They certainly do. According to the charges, the British member of the group had verified his accounts using his own driving licence. The man in Orlando did the same thing with his Coinbase account.

Olivia

So they basically signed their names on it.

Sean

With a photo. Their real names came out on the thirty-first of July. Mason Sheppard, nineteen, from Bognor Regis in England, was "Chaewon." Nima Fazeli, twenty-two, from Orlando, was "Rolex."

Olivia

So which of them was "ever so anxious"?

Sean

Honestly, I couldn't find a clear answer, because the official papers use different nicknames.

Olivia

Fine. And the teenager in Tampa?

Sean

He was arrested early that same morning, at an apartment where he lived by himself.

Olivia

By himself? At seventeen?

Sean

Apparently so. His name is Graham Ivan Clark.

Olivia

Now, he was a minor at the time, so the federal authorities didn't name him. Because he was a juvenile, they passed his case to prosecutors in Florida.

Sean

So why do we know his name?

Olivia

Florida allows minors to be charged as adults in some financial fraud cases, and prosecutors decided to do exactly that. The State Attorney announced his full name, and every major newspaper has used it since.

Sean

How many charges?

Olivia

Thirty felonies, including organised fraud and fraudulent use of personal information. The prosecutor, Andrew Warren, told reporters, "This was not an ordinary seventeen-year-old."

Sean

I suppose not. Most seventeen-year-olds are just trying to pass their driving test.

Olivia

And his was set at seven hundred and twenty-five thousand dollars…

Sean

…which, for a teenager, is…

Olivia

…no problem at all, according to his lawyer. He said Clark already owned more than three million dollars in bitcoin.

Sean

Three million? From where?

Olivia

Hold that thought.

Sean

Fine. So he goes to trial?

Olivia

He never did. In March 2021 he , by video from the county jail where he'd been since his arrest. He was eighteen by then.

Sean

And the sentence?

Olivia

Three years in prison, followed by three years of .

Sean

Three years? For hacking Obama? I expected at least…

Olivia

…ten, and that was the minimum for an ordinary adult. But the deal let him be sentenced as a "youthful offender," which is a Florida rule for people under twenty-one.

Sean

That seems rather generous to me, if I'm honest.

Olivia

I think it's fair. He was a kid…

Sean

…a kid who fooled a billion-dollar company and took money from hundreds of strangers.

Olivia

Seventeen, Sean. The prosecutor said the goal was to teach him a lesson without destroying his future. He'd already spent over seven months in jail, and he might even serve part of it in a military-style boot camp.

Sean

Boot camp. Well, I hope they make him run a lot.

Olivia

There were other conditions as well. He couldn't use computers without permission and supervision from the police. He also had to hand over his passwords.

Sean

I hope he kept them in a notebook next to the kettle.

Olivia

Your mum should work for the police.

Sean

So what about Twitter afterwards? Did anything actually change?

Olivia

Quite a lot, in the end. In September 2020 they finally hired a new head of security. They also started replacing phone notifications with physical security keys, which you plug into your computer.

Sean

And a phone call can't trick a USB stick.

Olivia

True. The regulator argued that big social media companies are now so important for news and elections that they need their own regulator.

Sean

And imagine if the next hackers are cleverer, because one fake tweet from a president could move markets.

Olivia

The prosecutor made exactly that point. And remember PlugwalkJoe?

Sean

No, you haven't mentioned him.

Olivia

Oh, sorry, I skipped him! He was a British hacker who got the handle six that day. He told the New York Times he'd been getting a massage in Spain while it all happened. About the police, he said, "They can come arrest me. I would laugh at them."

Sean

Oh dear. I can see where this is going.

Olivia

In 2023 he was extradited from Spain to the US and pleaded guilty in New York. That June he got five years, for the Twitter hack and several other cybercrimes.

Sean

Five years. That's two more than Clark, although Clark was sentenced as a youthful offender.

Olivia

I don't think he's laughing anymore.

Sean

No, probably not.

Olivia

Okay, folks, your verdict. Would three years have been fair for a grown adult who did exactly the same thing? Put it in the comment section.

Sean

Before anyone goes, though, you told me to hold a thought. Where did the three million come from?

Olivia

In 2019, hackers took over a Seattle investor's phone number and stole a hundred and sixty-four bitcoins. One of the extortion notes was signed "Scrim," which several of his online friends said was one of Clark's online names.

Sean

Wait. So the police knew about him before Twitter?

Olivia

In April 2020, three months before the hack, the Secret Service took a hundred bitcoins from Clark that matched the stolen coins. According to his own lawyer, investigators also gave him back three hundred more, because they'd decided not to charge him.

Sean

So they handed him three hundred bitcoins, and three months later he hacked Twitter.

Olivia

Seriously. Every twist is in a PDF you can download for free, linked below. Stay safe online, everyone.

Sean

Yes, and mind who you give your password to.

Want more stories at your level?

Aprendos has hundreds of podcast episodes with exercises that adapt to you.

Try Aprendos for free