The Ministry of Defence has launched an investigation after the British Army’s Twitter and YouTube accounts were hacked over the weekend and used to promote cryptocurrency scams.
The British Army Twitter account had its profile name changed several times, including to Bapesclan, a “metavestor clan on the ETH chain”, with a link to a fake NFT ‘minting’ website to encourage people to part with their money. At one point the profile and cover photo appeared to associate the account with an NFT collection called ‘Possessed’ and retweeted various NFT giveaways.
At the time of the attack, the army’s Twitter feed had 362,000 followers. An army spokesperson said it is aware of the breach and that an investigation is underway. “We take information security extremely seriously and are resolving the issue.”
At 9pm last night, the British Army account tweeted on its return to normal: “Apologies for the temporary interruption to our feed. We will conduct a full investigation and learn from this incident. Thanks for following us and normal service will now resume.”
The British Army YouTube account, which has 177,000 subscribers, streamed videos of an interview with Elon Musk and Twitter founder Jack Dorsey talking about cryptocurrency. The videos had “double your money” Bitcoin scams shown bordering the interview, and reportedly racked up thousands of views.
The interview was part of “The ₿ Word” conference in July 2021, reports Web3 Is Going Just Great blogger Molly White. Jack Dorsey, Elon Musk and Ark Investment founder Cathie Wood discussed Bitcoin as a tool for economic empowerment.
In May this year, scammers reportedly stole $1.3m in 24 hours by streaming the same video, along with fraudulent Bitcoin links, from compromised accounts.
Conference panel stream repurposed
It is not yet clear how the hackers accessed the accounts, but the Army said they were back to normal by Sunday evening. Jake Moore, global cybersecurity adviser at ESET said it may have happened due to different admins sharing the profile details, or a third party with weaker security measures managing the profile on behalf of the MoD.
“It can be extremely damaging for organisations and brands when their social media accounts are hacked and start advertising crypto or NFTs so it is vital that all social media admins are using multi-factor authentication and they change the password when anyone who knows it leaves,” Moore told Tech Monitor.
A Twitter spokesperson told The Verge that the account “has since been locked and secured” adding that “account holders have now regained access and the account is back up and running”.
This is the latest crypto-related attack on a high-profile social media account. In March top Super Smash Bros Ultimate player, MkLeo had his 217,000-follower Twitter account hacked and used to promote NFTs in a similar way to the British Army hack.
According to research provider Chainalysis, cryptocurrency-based crime hit an all-time high in 2021, with illicit addresses receiving about $14bn over the year, nearly double the 2020 figure.
Read more: The biggest cryptocurrency hacks of all time
