Home > News

How an Elon Musk Impersonator Made Off with $180k in Bitcoins on Twitter

By Simon Batt
How an Elon Musk Impersonator Made Off with $180k in Bitcoins on Twitter Featured Image

Twitter has always had a bit of an impersonation problem. In its early days there was little to prevent users from creating fake celebrity accounts and spreading misinformation. Since then Twitter has implemented the “verified user” blue tick you see next to people’s names. This tells the users they need don’t need to worry; every celebrity with the tick mark is the real deal, and any “celebrity account” without one is a fake, regardless of what they claim.

elon-impersonator-verified

This doesn’t mean people can no longer make a Twitter account and impersonate famous people. It does, however, mean that users will trust tweets from verified users more. This sort of trust is exactly what hackers covet. Should a hacker gain access to a verified account, they can use this heightened trust to spread malicious links which users click without a second thought. This, in turn, means that verified accounts have to be locked down tight to prevent this abuse.

The Verified Users Security Problem

This problem was shown off tenfold when hackers managed to gain access to verified Twitter accounts owned by various businesses. They changed the profile picture and avatar to that of Elon Musk. Despite the hackers changing the name and avatar, the blue tick icon stayed, thus giving the impression it was Elon Musk talking. The account kept the company’s original Twitter handle (as you can see below, with the “@farahmenswear” handle), but at a quick glance, it did look like the account was Elon’s own.

elon-impersonator-tweet

Next, they made a tweet stating that Elon Musk was stepping down as director and was giving away 10,000 BitCoin as a result. If you wanted in on the deal, you had to send BitCoins to him to verify your address. Once he received your coins, he would then send you ten times what you gave him. The maximum amount you could donate was three BitCoins, currently worth around $19,000USD.

What made it worse was that the scammers could get these fake tweets promoted on Twitter. This means they appeared on people’s timelines regardless of if they followed the hacked accounts or not. If users didn’t notice the mismatching Twitter handle, it was easy for them to believe this was a real tweet made by Elon Musk. It’s believed the scammers made $180,000 in BitCoins from the scam before it got shut down.

How to Deal with Scam Tweets

As we’ve seen above, a “verified user” tickmark does not automatically mean everything they link is safe. A verified account can be hacked and used to publish malicious content. Likewise, a verified account can be hacked, changed to look like a selected target, and then used to spread bad links around Twitter. Even a legitimate verified user can be tricked by others into sharing a bad link!

elon-impersonator-stress

When browsing the ‘Net, it’s always good to remember a key part of dodging scams: if it sounds too good to be true, it probably is. In this case Elon Musk retiring from his business and suddenly giving out sums of up to $60,000 to random Twitter users is probably not something you should buy into.

Also, if you see something fishy, be sure to check the Twitter handle. If it doesn’t match the user’s name, that’s a big warning sign that something’s amiss. In the case of the original account being hacked, however, you have to use common sense to dodge malicious attacks.

Verifying the Verified

The “verified user” check mark has helped prevent users from simply making an impostor account. At the same time, it has also led users to trust everything a verified user posts. This makes it ripe for hackers to take control of a verified account and use it as a platform to spread malware. But there are ways to take better care online.

Have you seen any Twitter impersonators in the wild? How successful were they in tricking people? Tell us your stories below.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Simon Batt Avatar
Simon Batt
Simon Batt is a Computer Science graduate with a passion for cybersecurity.

Read next

When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.