The internet is a place where everyone, everywhere is "around". You can talk about who to blame all you want, but blaming the attackers just means that you'll be attacked by people who don't care if you blame them. It's not an effective way of solving the problem.

And remember that "the problem" is that the attackers hijacked the accounts of people using twitter. Twitter had a duty to take adequate measures to protect those accounts, and failed to do so. The victims are the people whose accounts were stolen, and the people who were defrauded by the hijacked accounts.