A 17-year-old phoned Twitter's help desk — and took over Obama, Musk and Biden's accounts

On July 15, 2020, a group of hackers — led by 17-year-old Graham Ivan Clark — used a phone-based social engineering attack ('vishing') to trick Twitter employees into providing access to internal administrative tools. With these tools, the hackers took control of 130 high-profile accounts, including Barack Obama, Elon Musk, Joe Biden, Bill Gates and Apple.

The compromised accounts posted a Bitcoin scam promising to double any cryptocurrency sent to a specific address. The scam collected approximately $117,000 in Bitcoin before Twitter regained control. The attack was not a technical exploit — it was a human one: the hackers talked their way into the admin panel.

The case exposed the vulnerability of even the most prominent technology platforms to social engineering. Twitter's internal tools gave employees broad access to user accounts, and the authentication for those tools was insufficient to resist a phone call from a convincing teenager. The incident prompted Twitter (and the broader industry) to strengthen internal access controls and implement hardware security keys for administrative functions.