Twitter called it a "social engineering attack", which makes me think that it was something simple like: the attacker called Twitter support, said, "Hey, it's <Elon Musk Bill Gates etc.>. Wouldn't you know it, I lost my 2FA device and my password. Could you help me?" And then the Twitter support person was like, "Sure, just give me your birthday for verification and I'll have this fixed right away, sorry for the inconvenience!"
Support people want to
help the person they're talking to as quickly as possible. They're usually the weakest link, not any technical flaw. You see this same sort of social engineering used in SIM swapping attacks, common against Bitcoiners. (There's a victim of SIM swapping on the front page ofr/Bitcoin right now.)
There are some rumors circulating on twitter that the scam was just a cover for something else. For example, stealing direct messages from users, destroying twitter's reputation or something like that.
The DMs from all of those people might indeed be worth more than the $100k he got from the simple doubling scam.
Highly unlikely that it was a social engineering attack. The fact that they breached dozens of accounts practically simultaneously indicates this is near impossible.
There's no chance you could just call up and get some of these people's accounts with SE, even a moron Twitter support guy would notice some of these names.
Looks like every single account breached had a blue checkmark, so it might be a flaw in the verification systemor maybe these were just priority targets.
Surprised they didn't just pump some shitcoin then go long with 100x leverage. They could have easily caused a x50 pump on something with a smallish market cap. What a moron.
If they did manage to access DMs, then it's game over for Twitter. That is a devastating breach. TwitterGate coming up?
