Do people actually use DMs on Twitter for anything?

I'm reasonably active on Twitter, but I'm not famous and don't have a ton of followers. Are DMs a common method of communication for high profile accounts?

I'd suspect not (since I'd think most high profile accounts have people that run them).

I'd guess the simple (dumb) explanation for this hack is probably the true one.

But if that was your goal, why wouldn't you just remain silent and allow your targets to continue to use the platform? Presumably a live data feed is strictly better than one than one that immediately dries up.

The attack requires changing the email and disabling mfa, the target and Twitter would know pretty quickly. You also have no way to prove to outside parties that you actually had control the account afterwards. This way there is trivial proof that you had control of the account by simply sending some btc from the address.

They got their access by changing email addresses and disabling 2FA. There was no way to remain undetected.

That makes more sense and this way they can prove at least prove they have the bitcoin private keys. Reduces some of the deniability that the DMs were faked.

If I understand correctly, the real users were locked out. Doesn't that mean that they couldn't send DMs?

Now, sure, you could gain access earlier, capture DMs for a while, then lock out the real users, post the bitcoin scam messages, collect what you can in bitcoin, and still have the captured DMs as your real haul from the attack.

I'm assuming your second scenario is what went down: gain access to target accounts, export DMs, then execute the public bitcoin scam as proof of work.

Yeah, what ppl mean by collecting DMs is getting copies of years' worth of private conversations that the accounts likely engaged in over Twitter DMs (not so much about continued surveiling of new DMs)

You don't have to have the actual DMs. You can make shit up and claim the source is this attack.

Unless they can prove control of the bitcoin wallet used for the attack, or show a portion of the DMs, no one will take them seriously.

And then you're forfeiting access by "burning that bridge"?

I think they would just keep it for as long as they could. You set an app (a token) on the account and just ride with it

High chance it would be detected and blocked. The hack involved changing the email, disabling mfa and locking the user out. You can change the email back but their password and mfa would still be gone. They'd also get an email notifying them of the change. For professionally managed accounts that's going to be an instant red flag.

Then you have no proof you ever had access to the account.