Twitter has been fully recovered after it was hacked to defraud Bitcoin

Original title: "Chengdu Link Security: Recovery Analysis of Bitcoin Fraud On Twitter Account"

Source: Chengdu Chain security

I. Event overview

- On July 15, 2020, a large number of Twitter accounts were affected in a large-scale attack against Twitter.
- The scam began when the attacker took over the account AngeloBTC of an employee working on BitMEX.
- At least 30 high profile accounts were affected over the next four hours.

Second, the fraud event disk analysis

Wednesday, July 15, 2020, the massive Twitter attack targeted the Twitter accounts of a number of high-profile individuals, large companies and certain digital currency exchanges. Most of the accounts taken over by the attackers were used to post BTC scams, including those of former US President Barack Obama, celebrity Kim Kardashian, Bill Gates and Silicon Valley's "Iron Man" Elon Musk.

In a statement, the company explained that in the massive attack on Twitter, hackers gained access to internal systems, attacked some Twitter employees' accounts and changed the E-mail addresses of more than 30 high-profile accounts.
But how did all this happen?

The first hijacked account was AngeloBTC, the account of a trader working on BitMEX, which posted a Twitter message at 8:16 p.m. Edt on July 15, 2020, inviting users to join a paid Telegram group he had created to obtain certain trading information. But the tweet was quickly deleted, suggesting that the message was not posted by its actual owner. Although the tweet was deleted, the attacker could fool someone in a similar way.

Figure 1 (source: Twitter)

Instead of giving out bitcoin addresses directly, the hackers send them to people who want to join a paying group via a private message. The address (1 ai52uw6usjhpcdrwsmkuvjuqlpcznuuyf) until the attack is exposed, received 7.4 BTC (about $67654), on July 17, 2020, to balance out.

Figure 2 (Data from Bitinfocharts)

A second message an hour later from Binance's account tweeted that the company was working with the "CryptoForHealth" community to return 5000BTC to community members.

Figure 3 (From Twitter)

Attacker released web address link to the second BTC (bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh), the next hour, this address is also used to use other then accused of account of this paper.

Figure 4 (Source BitcinfoCharts)

Now open the cryptoforheal.com web site, and Metamask will suggest that the site is a phishing site.

Figure 5

After ignoring the phishing tip, enter the site to see detailed fraud information.

Figure 6 (Cryptoforhealth.com)

Then sent a Ripple of account tweets, says it is will be returned to their XRP 2000 XRP to address (rhYSX8qSpoU7Dwjh6vMSuACu8MBECn6bQR) sent more than 1000 Ripple for Covid - 19 fund random address.

Figure 7 (Sources and Twitter)

After the Ripple account attack, the hackers moved their target from cryptocurrency-related accounts to mainstream celebrity and large corporate accounts.
With nearly 37 million followers, Elon Musk, Bill Gates, Uber, Apple and former President Barack Obama are among the silicon Valley's "Iron Man." The specific timeline is as follows:

Figure 8 (Data from block study)

Before Twitter to take corresponding measures, the last post messages fraud account belongs to Kim kardashian, this account has released the third BTC address (bc1qwr30ddc04zqp878c0evdrqfx564mmf0dy2w39l). Its income and expenditure are as follows:

Figure 9 (Source BitinfoCharts)

Although the hackers published three addresses, analysis of the linked transaction data showed that the attack was orchestrated by the same hacker (or hacker group).

Some safety advice

For personal encryption currency holders, chengdu double chain Ann suggested that don't believe that return this kind of matter, want to believe that "when you stare at the deep, deep also to gaze at you", if you want to make money investment, please select the stable channel, "heaven fell pie" good please calm analysis of the following relevant information, fraud prevention consciousness, must strengthen the assets to avoid property damage.

As for the company, Chengdu Lianan suggests that the management of media accounts must strengthen risk control, public opinion monitoring and personnel safety awareness training, so as to avoid the bad influence caused by omissions and damage to the company's reputation.

Text link:https://www.lianantech.com/#/news/

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia