Authorities in Tampa, Florida, arrested 17-year-old Graham Clark early Friday morning and accused him of masterminding a massive hack of high-profile Twitter accounts earlier this month.
The July 15 attack saw accounts belonging to political figures like Joe Biden and Barack Obama, and tech founders like Elon Musk, Bill Gates and Jeff Bezos, among others, all temporarily wrested from their owners. The hijacked accounts then directed followers to send bitcoin to an address, promising that those who followed through would see their money returned in double.
The cryptocurrency was not returned; instead, Clark pocketed more than $100,000 in just one day, the Hillsborough State Attorney’s office told HuffPost.
Authorities also charged two other individuals in the scheme: 19-year-old Mason Sheppard, aka “Chaewon,” of Bognor Regis, in the United Kingdom; and 22-year-old Nima Fazeli, aka “Rolex,” of Orlando, Florida.
A Twitter investigation found the trio initially targeted specific Twitter employees who had access to internal support tools. Using their credentials, they pursued additional permissions available to other Twitter employees who oversee account support, which they then ultimately used to hack the accounts.
Of the 130 Twitter accounts he targeted, the group sent tweets from 45, accessed the direct messages of 36, and downloaded data from seven, Twitter said.
Beyond the immediate theft, the hack raised grave concerns about Twitter’s security apparatus ― and what might happen if someone more interested in sowing chaos than stealing bitcoin were able to carry out a similar hack in the future.
The Hillsborough State Attorney’s Office is leading the prosecution because Florida law permits charging minors as adults in certain financial fraud cases. The FBI and U.S. Department of Justice also contributed to the investigation.
“This defendant lives here in Tampa, he committed the crime here, and he’ll be prosecuted here,” State Attorney Andrew Warren said in a release.
“Scamming people out of their hard-earned money is always wrong,” he added. “Whether you’re taking advantage of someone in person or on the internet, trying to steal their cash or their cryptocurrency — it’s fraud, it’s illegal, and you won’t get away with it.”
Clark faces 30 felony charges, including one count of organized fraud over $50,000, one count of fraudulent use of personal information of 30 or more victims, 17 counts of communications fraud and 10 counts of fraudulent use of personal information.