Dozens of high-profile Twitter accounts were hacked Wednesday afternoon, including those of Tesla CEO Elon Musk, Microsoft co-founder Bill Gates, Amazon CEO Jeff Bezos, former Vice President Joe Biden, musician Kanye West, Apple, and Uber. The accounts were used to tweet a familiar cryptocurrency scam, which appears to have successfully netted more than $100,000 in the space of a few hours.
The breadth of the hack has led to speculation that it may have been accomplished using internal Twitter tools, which would mark a major security failure on Twitter’s part.
Asked for a statement, Twitter directed Fortune to its @twittersupport account, where the company at 5:45 pm wrote: “We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly … You may be unable to Tweet or reset your password while we review and address this incident.”
Verified Twitter users were unable to tweet for some time, apparently part of an effort by Twitter to tamp down the scam messages.
A tweet sent from Elon Musk’s account was representative of the posts, inviting his 36.9 million Twitter followers to send Bitcoin to a specific address on the promise that Musk would send double the money in return. Similar misleading pitches have been common on Twitter for years, but only occasionally have actual hacked accounts been used, and never before at this scale.
The list of accounts tweeting similar messages also included the corporate accounts of cryptocurrency companies Ripple, Binance, Gemini, Coinbase and KuCoin; the personal accounts of Ethereum creator Vitalik Buterin, Litecoin creator Charlie Lee and Binance CEO Chengpeng Zhao; and the accounts of dozens of lesser-known cryptocurrency analysts and traders.
Some sent tweets nearly identical to Musk’s, while others are touting a supposed partnership with something called “Crypto for Health,” with a similar promise of giving away cryptocurrency. Some Twitter users are reporting that the “Crypto for Health” link in those tweets leads to malware.
Musk, Gates, Apple and others appear to have quickly regained control of their accounts and deleted the deceptive tweets. But at least some damage was already done. The same bitcoin address was tweeted from the accounts of Gates, Musk, Apple, and Uber, and at this writing, it had received just over 11 bitcoin, worth roughly $105,000.
