Scam Screenshots: The Twitter Bitcoin Scandal

memetic influence
Jul 18, 2020 · 3 min read

Disclaimer: Please do not send Bitcoin to any of the addresses listed in this article. You will be funding scammers and will not receive your money back.

Twitter was the subject of a major breach on July 15, 2020, which disrupted the service

Scammers promoted a bitcoin address to thousands of people by breaching into and tweeting from major accounts, including @BarackObama and @Uber

Screenshots of the scam tweets continue to circulate the scammer’s bitcoin address after the original tweets have been deleted

Twitter was the subject of a widespread bitcoin scam affecting many major, verified users of the platform on July 15, 2020. The tweets spurred viewers to send Bitcoin to a specific account. Authenticity was fabricated with Twitter users as the scammers gained access to Twitter’s internal systems and then spread their message in a coordinated manner through major accounts including Bill Gates, Uber, and Barack Obama. For more information on the scam: Krebs on Security, New York Times, Wired

The scam tweets instantly created a meme-able screenshot format:

Screenshots including the Bitcoin address spread the scam farther, even after Twitter locked down the affected accounts and removed the scam tweets. Anytime a Bitcoin address is presented to a person, it creates yet another opportunity for a susceptible viewer to bite and send Bitcoin. The effectiveness of the scam is extended regardless of whether the Bitcoin address was presented to someone by the original scam tweet, or through a circulating screenshot elsewhere.

Screenshots of the actual scam tweets used in reporting contexts will continue to propagate the bitcoin address long after the tweets have been deleted. Twitter users posting transaction receipts after being scammed propagate the scammer’s bitcoin address as well.

The scam tweet format’s relatively simple four-line construction allowed for easy recreation. Fabricated screenshots mocking the situation were quickly created and circulated. These parody screenshots of tweets that never even existed propagate the scammer’s bitcoin address. Given their incorporation into other memes, the address will spread through humorous contexts, too.

The widespread propagation of these screenshots in factual, commentary, or humorous contexts effectively extends the scam to new viewers even after Twitter removed the original tweets. People will continue to fall for the scam and send Bitcoin to the address regardless of the context it is presented in, as presentation of the address creates the potential for a viewer to get scammed.

Overall, fabricated screenshots can effectively spread any content from a “reliable source.” Be careful with any information in a screenshot received from or posted by a friend or relative. Read Don’t get tricked: Checks on fake news that anyone can do from First Draft News for more tips on spotting mis/disinformation.

Our dataset for the Celebrity Bitcoin Scam can be found at the following link: https://github.com/memeticinfluence/celebrity-bitcoin-scam

You can analyze this data and the spread of any coordinated imagery here: https://www.maltego.com/blog/mapping-visual-disinformation-campaigns-with-maltego-and-tineye/

Visit us at www.memeticinfluence.com

memetic influence

tools + intelligence + content for social network analysis

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store