Hackers tell the story of the Twitter attack from the inside

A Twitter hacking scheme that targeted political, corporate and cultural elites this week began with a teasing message between two hackers late Tuesday on the online messaging platform Discord.

“yoo bro,” wrote a user named “Kirk,” according to a screenshot of the conversation shared with The New York Times. “i work at twitter / don’t show this to anyone / seriously.”

Read: What the Twitter hack revealed: An election system teeming with risks in US

He then demonstrated that he could take control of valuable Twitter addresses — the sort of thing that would require insider access to the company’s computer network.

The hacker who received the message, using the screen name “lol,” decided over the next 24 hours that Kirk did not actually work for Twitter because he was too willing to damage the company. But Kirk did have access to Twitter’s most sensitive tools, which allowed him to take control of almost any Twitter address, including those of former President Barack Obama, former Vice President Joe Biden, Elon Musk and many other celebrities.

Despite global attention on the intrusion, which has shaken confidence in Twitter and the security provided by other technology companies, the basic details of who were the people responsible, and how they did it, have been a mystery. Officials are still in the early stages of their investigation.

But four people at the center of the scheme spoke with The Times and shared numerous logs and screenshots of the conversations they had on Tuesday and Wednesday, demonstrating their involvement both before and after the hack became public.

Also Read: Online attack targets VIP twitter users like Biden, Obama, Elon Musk, Bill Gates in Bitcoin scam

The interviews indicate that the attack was not the work of a nation-state or a sophisticated group of hackers. Instead, it was done by a group of young people — one of whom says he lives at home with his mother — who got to know one another because of their obsession with owning early or unusual screen names, particularly one letter or number, like @y or @6.

The Times verified that the four people were connected to the hack by matching their social media and cryptocurrency accounts to accounts that were involved with the events Wednesday. They also presented corroborating evidence of their involvement, like the logs from their conversations on Discord and Twitter.

Playing a central role in the attack was Kirk, who was taking money in and out of the same Bitcoin address as the day went on, according to an analysis of the Bitcoin transactions by The Times, with assistance from the research firm Chainalysis.

But the identity of Kirk, his motivation and whether he shared his access to Twitter with anyone else remain a mystery even to the people who worked with him. It is still unclear how much Kirk used his access to the accounts of people like Biden and Musk to gain more privileged information, like their private conversations on Twitter.

Also Read: Here are the tweets sent by hackers from handles of Biden, Bezos, Gates, Obama and others

The hacker “lol” and another one he worked with, who went by the screen name “ever so anxious,” told The Times that they wanted to talk about their work with Kirk in order to prove that they had only facilitated the purchases and takeovers of lesser-known Twitter accounts early in the day. They said they had not continued to work with Kirk once he began more high-profile attacks around 3:30 p.m. Eastern time Wednesday.

“I just wanted to tell you my story because i think you might be able to clear some thing up about me and ever so anxious,” “lol” said in a chat on Discord, where he shared all the logs of his conversation with Kirk and proved his ownership of the cryptocurrency accounts he used to transact with Kirk.

“lol” did not confirm his real-world identity but said he lived on the West Coast and was in his 20s. “ever so anxious” said he was 21 and lived in the south of England with his mother.

Investigators looking into the attacks said several of the details given by the hackers lined up with what they had learned, including Kirk’s involvement both in the big hacks later in the day and the lower-profile attacks early Wednesday.

The Times was initially put in touch with the hackers by a security researcher in California, Haseeb Awan, who was communicating with them because, he said, a number of them had previously targeted him and a Bitcoin-related company he once owned. They also unsuccessfully targeted his current company, Efani, a secure phone provider.