When Obama’s Twitter asked you for bitcoin
July 2020. Real verified accounts, fake hands. A checkmark is not a person in the room.
In July 2020 a pile of verified Twitter accounts posted the same bitcoin pitch: send coins, we send back double. Barack Obama, Elon Musk, Apple, Uber, Joe Biden. The accounts were real. The people were not at the keyboard. Attackers socially engineered Twitter staff, got into internal tools, and pushed the tweets. They collected hundreds of thousands of dollars in a few hours. Twitter locked down. The posts vanished. The lesson did not.
Verified is not a person in the room
A checkmark means the company tied the account to a claimant at some point. It does not mean the person is typing. It does not mean the staff who can post as that person were having a good day. If a celebrity asks you to send crypto to a wallet in the tweet, that is a scam even when the name is right.
The same trick exists in smaller clothes: a hacked Instagram, a cloned WhatsApp, a nephew who “needs iTunes cards.” You confirm on a second channel. You do not confirm by replying to the suspicious message.
Why employees get targeted
Internal admin panels are treasure. Phishing a helpdesk is often cheaper than phishing a million users. That is not an excuse for the company. It is a reason you should not treat a platform as a notary. Your own accounts need 2FA so a similar tool against you is harder. Their failure is not your wire transfer.
A rule that survives the next hijack
Money and coins do not move because a famous name appeared on a screen. They move because you independently wanted that trade. If the urgency is “only for the next 30 minutes,” walk away. The Twitter hour was a carnival. The quieter versions happen in group chats every week.