Twitter Hack: What Happened and What Should You Do?

The widely reported Twitter hack happened on July 15, 2020. Attackers took over a number of prominent accounts and used them to promote a cryptocurrency scam. Twitter said about 130 accounts were targeted, and that attackers downloaded account information in some cases, including direct messages.

This is a historical incident, not evidence of a new 2026 breach. If you are reacting to a fresh post or alert, verify that specific claim before clicking links or changing settings through a message. Check Twitter/X’s own account notices and status communications, then look for independent confirmation from reputable news organizations.

The 2020 incident mattered because the attackers got into internal company tools, rather than merely persuading individual users to hand over passwords. It showed that a platform’s internal access controls can affect even accounts with strong security habits. It did not mean that Twitter users’ cryptocurrency wallets were directly hacked.

The attackers used social engineering to target Twitter employees. In broad terms, social engineering means manipulating a person into giving up access or taking an action that helps an attacker. The attackers then gained access to internal tools that could be used to control accounts.

Twitter said approximately 130 accounts were targeted. The attackers took over high-profile profiles and posted messages promoting a Bitcoin scam. The posts urged people to send cryptocurrency, claiming they would receive more back. The promise was fraudulent: sending crypto to an address controlled by a scammer does not create a reliable way to get it back.

The central lesson is that a verified badge, familiar profile picture or large follower count does not prove a post is genuine. A compromised account can publish a convincing scam in the account owner’s name. Treat urgent requests for crypto, giveaways that require an upfront transfer, and claims of guaranteed returns as warning signs, even when they appear on a well-known account.

The scope included account takeovers and access to some account information. Twitter said attackers targeted about 130 accounts. In some cases, they downloaded account data, including direct messages. The available reporting does not establish that every targeted account had its messages downloaded, so don’t assume that all users’ private messages were exposed.

If you received a suspicious message or shared information with someone during the incident, be alert for follow-up phishing. Attackers can use details from messages to make a later email or direct message seem personal and trustworthy. A message that knows your name or recent activity can still be a scam.

The reports describe account information being accessed; they do not establish that users’ crypto wallets or private keys were taken through Twitter. A social-media account and a self-custody wallet are separate systems. Still, if you sent cryptocurrency to a scam address, preserve the transaction details and report it to the relevant exchange or authorities. Crypto transfers are generally difficult or impossible to reverse.

If you think your account may be involved in a current incident, use this order:

1. Don’t act on a message or post alone. Open the app or account settings directly; don’t follow an unfamiliar link in an alert.
2. Change your password to a unique one you do not use on other sites. If you reused it elsewhere, change it there too.
3. Review active sessions and connected apps. Sign out of sessions and revoke access you do not recognize.
4. Turn on two-factor authentication. Use an authenticator app or security key where supported, and protect your recovery methods.
5. Secure your email account. It can be used to reset your social-media password, so give it its own strong password and two-factor authentication.
6. Check recent posts, messages and account details. Remove unauthorized content and correct profile changes after regaining control.

If you cannot sign in, use the platform’s official account-recovery process by navigating to the service yourself. Do not pay someone who promises to restore your account, and never give a supposed support agent your password or one-time login code.

A compromised social account can make a crypto scam look credible, but a post is not proof that a giveaway or investment offer is real. Never send cryptocurrency because an account says it will double your deposit, return a larger amount or unlock a prize. Legitimate customer support does not need you to transfer crypto to verify ownership.

Before taking any action, check whether the account owner has confirmed the offer through another trusted channel. Be especially cautious of replies, lookalike accounts and direct messages that repeat a viral post. Scammers often use urgency, limited-time language or threats of losing access to rush you into a transfer.

If you have already sent crypto, save the transaction ID, destination address, screenshots and any messages. Contact the exchange you used to send the funds and report the scam to the appropriate local authorities. Do not trust recovery services that ask for an upfront fee or your wallet’s recovery phrase. Sharing a seed phrase can give someone control of the wallet itself.

A password alone may not stop an attacker who can access a company’s internal account tools, as the 2020 incident illustrated. You can still reduce the damage if your own login is exposed:

• Use a different, long password for every important account; a password manager can help you keep them separate.
• Enable two-factor authentication and keep recovery codes somewhere private and secure.
• Protect the email address and phone number used for account recovery.
• Review logged-in devices and connected applications from time to time.
• Be wary of unexpected login warnings, support messages and requests for verification codes.
• Avoid signing in through links in direct messages, emails or replies; navigate to the service yourself.

Two-factor authentication is not a guarantee against every form of account compromise. Never approve a login prompt you did not initiate, and do not read a one-time code to someone who calls or messages you. If you receive a password-reset notice you did not request, go to your account independently and review its security settings rather than using the notice’s link.

Several common reactions can make a breach claim more dangerous:

• Forwarding an alarming link without checking it. It may lead to a fake login page or malware. Verify the claim through a separate, trusted channel.
• Trusting a familiar account automatically. High-profile accounts can be taken over; assess the content, not just the name or badge.
• Sending crypto to test a promise. A small transfer is still a real transfer and may not be recoverable.
• Reusing a password. One exposed password can put other accounts at risk, especially email and exchange accounts.
• Sharing a login code or recovery phrase. A real support process should not require your password, one-time code or wallet seed phrase.
• Assuming every targeted account had the same data exposed. The incident involved different types of access; take sensible precautions without treating every claim as confirmed.

If someone says a new hack is underway, avoid posting private details in public replies. Secure your account through official settings, report suspicious content and wait for reliable confirmation before acting on instructions.

The known 2020 incident was an employee-targeted attack that enabled access to internal tools, account takeovers and a Bitcoin scam. Twitter said about 130 accounts were targeted and that account information, including direct-message data, was downloaded in some cases. That does not mean every account or message was affected, and it does not show that users’ crypto wallets were directly compromised.

For you, the practical response is to treat posts from even familiar accounts with care, never send crypto for a promised return, and keep your login, email and recovery methods secure. If you have seen a new 2026 claim, verify it separately before clicking a link, sharing a post or entering credentials. A real security warning should not require you to reveal a password, login code or wallet recovery phrase.