KIRK▊
For one afternoon in July 2020 a 17-year-old from Tampa owned the blue-check heavens. Posing as IT support, he talked his way into Twitter's internal admin panel — the one that can change any account's email and switch off two-factor with no warning to the owner — and turned Obama, Biden, Musk, Bezos, Gates, Kanye, and Apple into a single tiled billboard for the oldest scam on the internet: send bitcoin, get double back. The heavens obliged. In hours the wallet took in almost thirteen bitcoin, about $117,000, from people who believed the most powerful accounts on earth had suddenly gotten generous. He was famous by dinner and arrested within weeks. The kingdom of verified humanity, it turned out, had one skeleton key, and a teenager socially engineered his way to it — for coin and clout.
Everyone is asking me to give back. You send $1,000, I send you back $2,000.
Not Clark's words — the scam text posted through the hijacked accounts, here from the tweet pushed out of Bill Gates's seized account on July 15, 2020, as quoted by BBC News. The same double-your-bitcoin pitch went out from Obama, Biden, Musk, Bezos, and dozens more.
- WHO
- Graham Ivan Clark — "Kirk"; b. ~2002, of Tampa, Florida; 17 years old at the time of the offense FACT
- SCENE
- The OGusers / SIM-swap underground — the "OG" short-handle account trade and the SIM-swapper crowd federal prosecutors have elsewhere called "The Community." Clark was reported as the "Kirk" who claimed a Twitter-employee hookup ATTRIBUTED
- THE DRAMA
- The July 15, 2020 Twitter hack: internal admin tools seized via social engineering, ~130 accounts targeted, 45 tweeting a double-your-bitcoin scam — Obama, Biden, Musk, Bezos, Gates, Kanye, Apple — that took in almost 13 BTC (~$117,000) in a single afternoon FACT
- RECORD
- Charged by Hillsborough County, Fla. with 30 felony counts and prosecuted as an adult; pleaded guilty March 16, 2021 to a three-year sentence in a juvenile facility plus three years' supervised release, under Florida's Youthful Offender Act FACT
- STATUS
- PLED & SENTENCED — convicted as a youthful offender in state court; the record is closed, the receipts are not
This one isn't a vendor lie or a compliance grift — it's a heist file, and a lesson about attack surface. The most valuable identities on the internet were protected by an internal support console that trusted whoever was on the other end of the phone. A kid from Tampa who traded short usernames in the SIM-swap scene reached that console the way scene kids always do: he talked a human into it. The tools were god-tier; the entry was a phone call. Every beat below is from Florida court filings, the federal charging documents, Twitter's own post-mortem, and Brian Krebs's contemporaneous reporting.
the drama timeline
ACT I — THE SCENE (before July 2020)
Short usernames are currency and status. The people who trade them collect one thing above all: a warm contact inside a platform.
-
2019–20
The OG trade and the "Twitter rep"
In the OGusers world — a forum built around hijacking and reselling "OG" short-character handles like @6 and @B, which fetch thousands — the prized asset is a line inside a platform. Per Krebs, a user called "lol" introduced himself to the forum precisely that way: "I have a twitter contact who I can get users from... and I believe I can get verification from." This is the milieu the July 15 hacker, known to the others only as "Kirk," emerged from — someone claiming to be, or to have, a Twitter employee.
ACT II — THE AFTERNOON (July 15, 2020)
One social-engineering call, one internal console, and the most recognizable accounts on earth all start saying the same thing.
-
JUL 15, 2020 · ~2 PM EDT
Inside the admin panel
By Twitter's own account, the attackers ran a phone spear-phishing attack on a small number of employees, tricking them into surrendering credentials to internal tools. The console's power, as the owner of the hijacked @6 account described it to Krebs: "Within Twitter's admin tools, apparently you can update the email address of any Twitter user, and it does this without sending any kind of notification to the user. So they could avoid detection by updating the email address on the account first, and then turning off 2FA." First the attackers grabbed OG handles; then they aimed higher.
-
JUL 15, 2020 · ~3 PM EDT
Send $1,000, get $2,000
The scam tweets begin. From Binance and other crypto exchanges, then from Barack Obama, Joe Biden, Jeff Bezos, Elon Musk, Bill Gates, Michael Bloomberg, Warren Buffett, Kanye West and more, a single message tiles across the platform: partner links and double-your-bitcoin pitches. Twitter later said the attackers targeted about 130 accounts, tweeted from 45, accessed the direct messages of 36, and downloaded the full account history of seven. The corporate accounts of Apple and Uber were among those hit.
-
JUL 15–16, 2020
$117,000 in a few hours
Ridiculous on its face — and it worked anyway. The bitcoin wallet promoted by the hijacked profiles processed 383 transactions and took in almost 13 bitcoin, roughly $117,000, before the accounts could be locked down. The heavens had opened, and enough people believed it.
ACT III — THE FALL (late July 2020 – March 2021)
Fame is a poor operational-security choice. Within weeks the "mastermind" has a name, a mugshot, and thirty felony counts.
-
JUL 31, 2020
"Kirk" gets a name
Federal prosecutors in Northern California charge two accomplices but decline to name the third defendant, saying juvenile proceedings are sealed. A Tampa NBC affiliate (WFLA) then reports that authorities arrested 17-year-old Graham Clark of Tampa as the alleged mastermind. Hillsborough County prosecutors hit him with 30 felony counts — organized fraud, communications fraud, fraudulent use of personal information — and announce he will be charged as an adult.
-
MAR 16, 2021
The plea
Clark pleads guilty in Hillsborough County to unauthorized access to a computer and multiple counts of communications fraud and fraudulent use of personal information. The deal: three years in a juvenile facility plus three years' supervised release, sentenced under Florida's Youthful Offender Act. He had already served 229 days. His lawyer said the ~$117,000 had been handed to authorities to be returned to the victims. He is also barred from using computers without law-enforcement permission and supervision.
ACT IV — THE CO-STARS (2020–2023)
The middlemen and the loudest bystander answered federally — and the one who kept doing crimes got the longest sentence.
-
JUL 31, 2020
Rolex and Chaewon
Alongside the sealed juvenile case, DOJ charges Nima "Rolex" Fazeli, 22, of Orlando (aiding and abetting access to a protected computer) and Mason "Chaewon" Sheppard, 19, of Bognor Regis, U.K. (conspiracy to commit wire fraud, money laundering, and unauthorized computer access) — the middlemen who, per the charging documents and reporting, brokered OG-handle sales with "Kirk" on the day of the hack.
-
JUN 23, 2023
PlugWalkJoe, five years
Joseph "PlugWalkJoe" O'Connor, the U.K. bystander who bragged his way into the story — "I don't care. They can come arrest me. I would laugh at them. I haven't done anything," he told The New York Times — was extradited from Spain, pleaded guilty in 2023, and drew five years. Most of that was for a separate spree of SIM-swap cryptocurrency theft, extortion, cyberstalking, and swatting, not the Twitter afternoon. The joke, as another player in the case put it, is what got them into the mess.
both sides, on the record
The record: a Florida state guilty plea to unauthorized computer access and multiple fraud counts, from a 30-count felony charge; a three-year youthful-offender sentence; and a documented afternoon in which internal Twitter tools were used to seize ~130 of the most prominent accounts on the platform and run a bitcoin scam that took in about $117,000. The mechanism is not in dispute — Twitter published it, DOJ charged it, and the money moved on a public blockchain.
Fame did the rest: the hack was designed to be seen, so it was, and the "mastermind" was named within weeks. The scene he came from — OG-handle trading, a warm "Twitter rep," SIM-swap-adjacent clout — is documented in hacked-forum messages and co-conspirator interviews.
He was a minor: Clark was 17 at the time, sentenced under Florida's Youthful Offender Act — a framework built on the premise that a teenager can be rehabilitated, not just warehoused [5].
The money was recovered: his lawyer said the roughly $117,000 was handed to authorities to be returned to the victims — and the state framed the plea as a chance for him to mend his ways [6].
The role attribution is reporting, not a federal verdict against him: the federal complaint kept the juvenile sealed; the "mastermind" label and the "Kirk = Clark" link came from a local NBC affiliate and the state charges, and the state case resolved by plea rather than trial [3].
YOU DECIDE
The heist is adjudicated — he pleaded to it and was sentenced. What the file really documents is the gap between the power of a tool and the flimsiness of the door in front of it: the accounts of presidents and the richest men alive were one help-desk phone call from a stranger. A teenager with a taste for short usernames found the call, and for one afternoon the verified heavens all read from his script. He was famous by dinner, which is exactly why he was caught by month's end.
The archive doesn't moralize about a 17-year-old. It keeps the wallet address, the docket, and the tweet that fooled a hundred thousand dollars out of the crowd.
evidence locker
PRIMARY / CONTEMPORANEOUS REPORTING
BBC News — "Teen 'mastermind' pleads guilty to celeb Twitter hack" (Mar 17, 2021) FACT — the verbatim scam-tweet text, the youthful-offender sentence, the 229 days served, Apple and Uber among the targets, and the lawyer's restitution statement.
bbc.com/news/technology-56429204
COURT RECORD
CyberScoop — "Twitter hacker pleads guilty, sentenced to 3 years" (Mar 16, 2021) FACT — Clark's guilty plea in Hillsborough County, the three-year juvenile-facility term, the counts of conviction, and the NY DFS finding that the intruders posed as customer support.
cyberscoop.com/twitter-hack-guilty-plea-graham-ivan-clark/
FIRST-PARTY & CROSS-LINKS
troll.fan — LAPSUS$ CROSS-LINK — the teen-crew lineage: another young clout crew that owned giants (Nvidia, Microsoft,
Okta) with social engineering, not zero-days.
troll.fan/dossiers/lapsus.html troll.fan — Joel Ortiz CROSS-LINK — the same OGusers/SIM-swap scene one rung earlier: the first person convicted of SIM-swapping, whose cohort Clark came up in.
troll.fan/dossiers/joel-ortiz.html troll.fan — X / Twitter (the hacker drama) CROSS-LINK — the platform’s full break-in record; Clark’s 2020 takeover is the centerpiece of a decade of the same over-privileged-admin-tools failure.
troll.fan/dossiers/twitter-x.html troll.fan — Crew Rivalries CROSS-LINK — where the OG-handle / SIM-swap scene's feuds and middlemen sit in the larger map.
troll.fan/crew-rivalries.html
The standard. Graham Ivan Clark's guilty plea, three-year youthful-offender sentence, and counts of conviction are Florida state court record; the intrusion mechanism and account tally are from Twitter's own published post-mortem and the federal charging documents; the wallet math and scene detail are from Brian Krebs's contemporaneous reporting and a public blockchain. Clark was a minor, and this file treats him as one: the "mastermind" label and the "Kirk = Clark" identification are stated as what was reported and charged, not as our independent finding, and the mitigating facts — his age, the youthful-offender framework, the recovered money — are carried at full strength. Co-conspirators are named only as charged or sentenced. The "In their own words" artifact is the scam-tweet text, clearly labeled as the message posted through the hijacked accounts, not a personal quote. No motive beyond the record is asserted, and no operational detail beyond what Twitter and DOJ published is reproduced. If a line here couldn't survive scrutiny, it wouldn't be on the page.