Where Did the Twitter Hack Bitcoin Go? A Full Trace
Victims of the July 2020 Twitter hack sent 13.15 BTC. We traced each step with the Bitquery MCP server and found 3.93 BTC still sitting in the main scam wallet.
On 15 July 2020, hackers took over some of the best-known accounts on Twitter. Barack Obama, Joe Biden, Jeff Bezos, Elon Musk, Bill Gates, Apple, Uber and Binance all posted versions of the same offer: send Bitcoin here and get double back. Nobody got double back.
The scam ran for a few hours. We traced where the money went, step by step, with the Bitquery MCP server. You can ask the same questions in plain English and check every figure below yourself.
What happened
The hackers phoned Twitter staff, stole their logins, and used Twitter's own support tools to take over the accounts. Each hacked account then tweeted a Bitcoin wallet. Three wallets appeared in the tweets, and a fourth, never tweeted, collected the money. Chainalysis published all four in its one-week update.
| Role | Address |
|---|---|
| Main donation wallet, in most tweets | bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh |
| Second donation wallet | bc1q0kznuxzk6d82e27p7gplwl68zkv40swyy4d24x |
| Third donation wallet | bc1qwr30ddc04zqp878c0evdrqfx564mmf0dy2w39l |
| Cash-out wallet, never tweeted | 1Ai52Uw6usjhpcDrwSmkUvjuqLpcznUuyF |
We ran every trace on 15 October 2026 through the Bitquery MCP server. Each step below shows the question we gave the AI and the tool it called to answer. All times are UTC.
Step 1: how much did victims send?
We asked: "How much Bitcoin did each of the three scam wallets receive on 15 and 16 July 2020? Leave out transfers between the four wallets."
The AI used btc_transfers_raw_sql, which reads the Bitcoin ledger directly. Leaving out transfers between them stops the same coins being counted twice.
| Wallet | BTC received | Payments | First payment |
|---|---|---|---|
Main (bc1qxy2…0wlh) | 12.41 | 364 | 15 Jul, 19:04 |
Second (bc1q0kz…d24x) | 0.18 | 14 | 15 Jul, 21:02 |
Third (bc1qwr3…w39l) | 0.55 | 36 | 15 Jul, 22:10 |
| Total | 13.15 | 414 |
That total matches the 13.14 BTC Chainalysis reported a week after the hack. At the time it was worth about $120,000.
The largest single payment was 4.56 BTC, sent at 21:43 on 15 July (63015d32…f119). Most payments were far smaller.
It could have been worse. Coinbase blocked the main wallet within hours. The exchange said it stopped about 1,100 customers from sending 30.4 BTC, more than twice what got through.
Step 2: the wallet nobody tweeted
We asked: "Who did the main scam wallet pay, and how much?"
The AI used btc_address_flow_summary, which shows who a wallet paid, who paid it, and its lifetime totals.
| Paid to | BTC |
|---|---|
Cash-out wallet (1Ai52U…UuyF) | 5.70 |
bc1qjjcc…qslf | 3.87 |
bc1q5w26…a6s | 0.69 |
| 16 smaller payees, plus fees | 2.61 |
The main wallet spent 12.87 BTC in 13 transactions. The last one went out on 28 July 2020. Both smaller donation wallets passed their coins on to the main or cash-out wallet within half an hour.
The cash-out wallet is the most telling part of the trace. Its first payment arrived on 3 May 2020, ten weeks before the hack. And on 15 July it took in 7.39 BTC from outside the three tweeted wallets, starting at 10:36, more than eight hours before the first victim paid. Chainalysis also flagged extra coins arriving here and counted 7.88 BTC by its own method. Those coins did not come from the tweets, which suggests the hackers added coins of their own.
Step 3: the hand-offs
We asked: "Follow the largest payments out of the cash-out wallet. Stop at an exchange, a mixer or a known service."
The AI used btc_address_flow_summary on each new hop in turn, then labels_for_addresses to check each one against Bitquery's address labels.
The cash-out wallet spent 14.76 BTC in 18 transactions, all by 19:29 on 16 July. Every large branch then moved through a chain of fresh addresses. Most were used for a day or two and never again. The table counts hops from the cash-out or main wallet. Some hops mixed in small amounts from other addresses, so the last column shows what the final address received in total.
| Branch | Hops | BTC received at the last hop | Dates |
|---|---|---|---|
Via 3Chjur…eN5 | 3 | 3.79 | 15–20 Jul |
Via 3DA2ba…qWQ | 4 | 2.89 | 16–17 Jul |
Via 3BoE6N…HWM3 | 4 | 2.02 | 16–19 Jul |
From the main wallet, via bc1qjjcc…qslf | 2 | 3.00 | 16 Jul |
The first branch ends in an even split. On 20 July, one transaction took the 3.79 BTC at 1EszBG…77G3, added about 0.05 BTC from six other addresses, and paid out 30 amounts of exactly 0.128 BTC to 30 new addresses. Equal pieces like these are harder to tell apart than one large payment.
We checked 58 wallets from this trace against Bitquery's labels, the hackers' and the largest victims', including every address in the table. Only the main scam wallet carried a label. So the trace shows how the coins were broken up. It does not name the exchange where any of them landed. Without a label or a subpoena, an exchange deposit address looks like any other.
Step 4: the money that never moved
We asked: "Has the main scam wallet spent anything since July 2020? What has it received?"
The AI used btc_address_profile for the totals and btc_transfers_raw_sql for the yearly split.
Nothing has left the main wallet since 28 July 2020. Three days later, three people were charged over the hack. But Bitcoin kept arriving.
| Year | BTC received | Payments |
|---|---|---|
| 2020 (after 28 Jul) | 0.024 | 11 |
| 2021 | 0.051 | 88 |
| 2022 | 0.114 | 89 |
| 2023 | 0.114 | 62 |
| 2024 | 1.040 | 61 |
| 2025 | 2.234 | 245 |
| 2026 (to 13 Oct) | 0.345 | 195 |
| Total | 3.922 | 751 |
The wallet now holds 3.93 BTC. Most of it came years after the scam ended. One payment of 2.00 BTC arrived on 9 September 2025. Some of these payments may be people testing a famous wallet, and some may be mistakes. Either way, nobody has moved them.
What happened to the hackers
On 31 July 2020, Florida prosecutors charged Graham Ivan Clark, then 17, and the US Justice Department charged Mason Sheppard of the UK and Nima Fazeli of Florida. Clark took a plea deal and was sentenced to three years in prison in March 2021. Joseph O'Connor, known online as PlugwalkJoe, was sentenced to five years in June 2023 for his part in the hack and other crimes.
The case was solved off the ledger. On-chain, the coins split into fresh addresses within a day, and no label tied them to a person. Court filings show investigators used a leaked database from the OGUsers hacking forum, with its private messages and IP addresses, to identify one suspect, CyberScoop reported.
Run this trace yourself
Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing sits on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.
| Client | How to connect |
|---|---|
| Claude Desktop / Claude web | Settings, Connectors, add custom connector https://mcp.bitquery.io |
| ChatGPT | Settings, Connectors, add a connector with the same URL |
| Cursor | Settings, MCP, Add new MCP server |
| Claude Code | claude mcp add --transport http bitquery https://mcp.bitquery.io |
Then try these prompts:
How much Bitcoin did bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
receive on 15 July 2020?
Who did 1Ai52Uw6usjhpcDrwSmkUvjuqLpcznUuyF pay? Follow the
largest payment three hops and label each address.
Which addresses were spent together with this one?
The last prompt uses btc_related_addresses, which groups addresses that appear as inputs in the same payment.
For the method behind each step, read our guide on how to trace Bitcoin transactions and addresses.
Trace the money by asking an AI
Connect the Bitquery MCP server to Claude, Cursor or ChatGPT and ask in plain English where funds from an address went. The agent follows each hop, names the exchanges and mixers on the path, and returns the transactions behind every step.
Frequently asked questions
How much Bitcoin did the Twitter hackers get?
The three tweeted wallets received 13.15 BTC in 414 payments on 15 and 16 July 2020, about $120,000 at the time. Coinbase blocked a further 30.4 BTC from its customers.
Where did the Twitter hack Bitcoin go?
Most of it went to a cash-out wallet that was never tweeted, and from there through chains of single-use addresses within a day. Bitquery's labels do not name the exchanges at the end of those chains.
Is any of the Twitter hack Bitcoin still there?
Yes. The main scam wallet holds 3.93 BTC as of 15 October 2026. Almost all of it arrived after the hackers stopped spending in July 2020.
Who was behind the Twitter hack?
Florida and US prosecutors charged Graham Ivan Clark, Mason Sheppard and Nima Fazeli in July 2020. Clark was sentenced to three years. Joseph O'Connor was sentenced to five years in 2023.
Related reading
- How to trace Bitcoin transactions and addresses
- How to recover scammed Bitcoin
- How Upbit hackers laundered millions using crypto exchanges
First published on 17 July 2020. Rewritten on 15 October 2026: every figure was worked out again with the Bitquery MCP server, and AI tools helped run the queries and draft the text. Bitquery sells the MCP server named above. This post describes what the public ledger records. It names people only where courts or prosecutors have named them.
Subscribe to our newsletter
Subscribe and never miss any updates related to our APIs, new developments & latest news etc. Our newsletter is sent once a week on Monday.