The $1M Tweet: A Deep Dive into the 2020 Twitter Hack using Graph Data Science

How I used Python and Neo4j to visualize the digital fingerprint of the most famous Bitcoin “Giveaway” scam in history.

The day Twitter stood still

July 15, 2020 was a chaotic day on the internet. In a matter of minutes, the verified Twitter accounts of Elon Musk, Bill Gates, Barack Obama, Apple and Uber were compromised. They all broadcast the same eerie message:

“I am giving back to the community. All Bitcoin sent to the address below will be sent back doubled! If you send $1,000, I will send back $2,000. Only doing this for 30 minutes.”

It was a lie. A massive social engineering attack had given hackers the keys to the world’s loudest megaphones. While the world panicked about Twitter’s security, a different story was unfolding on the Bitcoin blockchain. The hackers weren’t interested in tweets; they were interested in the transaction that accompanied them.

In the few hours before the wallets were shut down, victims sent over 12 Bitcoin to the scammers. At the time, this was worth roughly $120,000. Today, that same haul would be worth over $1,000,000.

Today, I am not just reading about history. I am going to trace it. Using real on-chain data, Python, and graph database technology (Neo4j), I reconstructed the crime scene to understand exactly how a modern crypto heist operates.

The Problem with Linear Data

When I looked up the hacker’s address (bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh) on a standard block explorer, I got a spreadsheet—a list of inputs and outputs.

It told me what happened, but it didn’t tell me the story. It didn’t show me the panic of the victims or the frantic laundering attempts of the hackers. To see the structure of a crime, I needed to move beyond rows and columns. I needed a graph.

By modeling addresses as Nodes and transactions as Relationships (SENT/RECEIVED), I was able to turn a spreadsheet into a map.

The Investigation: Anatomy of a Scam

I built a simple Python pipeline to pull the complete transaction history of the hacker’s wallet from the mempool.space API and ingest it directly into Neo4j.

Once I loaded the data, the structure of the crime immediately leaped off the screen. The resulting graph is not random chaos; it is the definitive digital fingerprint of a “Giveaway Scam.”

The attack took place in two distinct phases, visible in the graph’s topology.

Phase 1: The “Fan-In” (The Honey Pot)

The first phase of the attack is aggregation. The hackers broadcast their message and wait for victims to take the bait.

In graph terms, this is called a Fan-In pattern. It is characterized by a high degree of “in-degree” connections to a single, central node.

When I zoomed into the center of my generated graph, I saw the hacker’s wallet as the central orange node. The surrounding cloud of green nodes represents the transaction hashes of unsuspecting victims.

Every line pointing inward is a victim hoping to double their money. They sent amounts ranging from 0.1 BTC to over 0.5 BTC. The density of this cluster visually represents the success of the social engineering attack — hundreds of disparate sources funneling value into one central location.

Phase 2: The “Fan-Out” (The Getaway)

The second phase is where the panic sets in for the hackers. They are sitting on a public pile of stolen loot, and the whole world is watching. They cannot simply send 12 BTC to a regulated exchange like Coinbase to cash out; their accounts would be instantly frozen.

They need to obscure the trail. They need to break the funds into smaller chunks and move them to fresh wallets, mixers, or unregulated services.

In graph terms, this is a Fan-Out pattern. It is the opposite of the aggregation phase. I was looking for single transactions that take a large input and split it into many smaller outputs.

When I looked at the periphery of my main graph, I saw these “starburst” or “flower” shapes.

Within hours of receiving the funds, the hackers initiated these transactions. A single green transaction node in the center takes funds from the main pot and “explodes” them outwards into 10, 20, or 30 new, fresh orange address nodes. This is the beginning of the laundering process, often called “peeling” or “layering.”

The Verdict: Visualizing the Crime Scene

When I combined these two patterns, I got the definitive picture of the event. A normal cryptocurrency user’s graph usually looks like a simple line or a small tree — money comes in, money goes out.

A scammer’s graph looks like a firework.

Below is the full visualization generated by my analysis in Neo4j Bloom. It shows the massive Fan-In at the center, where victims were lured by fake tweets, immediately surrounded by complex Fan-Out structures as the hackers scrambled to launder the proceeds.

Visualizing the “Hub and Spoke” Fraud Model. By mapping transaction relationships in Neo4j, the graph exposes the tactical footprint of the attackers. The high-indegree central node (orange) acts as the aggregation point for the attack, while the high-outdegree peripheral transactions (green) visualize the technique used to launder the proceeds through unverified exchanges.

Going Live: Building a Real-Time Radar

Tracing history is forensic science; tracing the present is surveillance. The analysis above shows us what the Twitter Hack looked like, but could we have caught it while it was happening?

By shifting the Python pipeline from a static historical pull to a Live WebSocket Listener, we can convert this graph from a history book into a radar.

In a live environment, we monitor the Mempool (the waiting room for unconfirmed transactions). Instead of analyzing the data once, we apply a continuous Cypher query that scans for specific topological changes in real-time.

The query I developed for this “Live Radar” looks for the Full 2-Hop Path:

MATCH (center:Address {address: $target_address})
OPTIONAL MATCH inbound = (victim)-[:SENT]->(tx)-[:RECEIVED]->(center)
OPTIONAL MATCH outbound = (center)-[:SENT]->(tx)-[:RECEIVED]->(launderer)
RETURN inbound, outbound

What this signifies in the real world

This query visualizes the two critical moments of a crypto-crime:

1. The Convergent Phase (The Scam): On the left side of the graph, we see independent, unconnected nodes (victims) funneling value into the center. In a live setting, seeing this “Fan-In” velocity spike is a definitive alert for a social engineering attack or a Ponzi scheme launch.
2. The Divergent Phase (The Laundering): On the right side, we see the central node “exploding” funds outward into fresh wallets. This represents “Peeling” or “Layering” — the attempt to wash the illicit funds before they can be frozen.

By visualizing these connected components (Victims -->Hacker -->Mules) instantly, we don’t just see the transaction; we see the intent.

Conclusion

While the hackers behind this attack attempted to use mixers (like Wasabi Wallet) later in the chain to further obfuscate those funds, the initial structure of their crime is etched permanently onto the blockchain.

By moving beyond simple block explorers and utilizing graph data science, I could turn raw, noisy data into clear forensic evidence. The structure is the story.