Teenage Twitter hacker pleads guilty, will serve 3 years in prison

A teenager who was arrested in July and accused of being the “mastermind” behind a high-profile attack involving Twitter agreed to plead guilty on Tuesday to fraud charges in Florida.

Graham Ivan Clark, now 18, will serve a three-year prison sentence, followed by three years of probation. The agreement's six years of total supervision are the maximum allowed under the state's "youthful offender" laws, though if Clark violates his probation he could face a minimum ten-year sentence in adult prison.

The agreement, which was first reported by the Tampa Bay Times, comes less than a year after celebrity accounts including those belonging to Kanye West, Jeff Bezos, Bill Gates, and Barack Obama, started tweeting out messages saying that they would send users money if they made a payment to a bitcoin address. 

“I am giving back to the community. All Bitcoin sent to the address below will be sent back doubled! If you send $1,000, I will send back $2,000,” one tweet read.

Twitter users sent more than $100,000 to the account before it was shut down. When Clark was arrested—as well as Mason Sheppard, who was 19 at the time, and Nima Fazeli, 22—the immediate question was how did a teenager manage to break into Twitter and take over some of its most high-profile accounts.

"He took over the accounts of famous people, but the money he stole came from regular, hard-working people. Graham Clark needs to be held accountable for that crime, and other potential scammers out there need to see the consequences," Hillsborough State Attorney Andrew Warren said in a statement.

According to court documents and public reports, Clark was able to convince one of Twitter’s employees that he worked in the technology department and needed credentials to access the customer service portal. The portion of the service that he had access to allowed him to control various aspects of accounts on the site.

Court documents reveal that the scheme wasn’t just a stunt—Clark quickly contacted other individuals to try to monetize his access. He approached Sheppard and Fazeli and said he worked at Twitter, and convinced them by tweaking the settings of one of their accounts and sold them access to short-form Twitter handles. The three advertised Clark’s ability to hijack accounts on the OGUsers forum.

But the scheme quickly fell apart, and according to The New York Times, federal agents had a search warrant to a home in Northern California less than a week after the incident. They interviewed another teenager who admitted to participating in the scheme, but was not named because they were a minor and gave authorities information that helped them identify other suspects.

"A great deal of impressive work has gone into stopping these fraud schemes and holding the people behind them accountable... [law enforcement agencies] quickly unraveled this mystery that stretched around the world, and then worked nonstop to catch the fraudsters who tried to take advantage of millions of unsuspecting people," Warren said.

Clark, who was also a minor at the time, was charged as a “youthful offender” by the Florida state attorney in Tampa, rather than face federal charges. His near eight months spent in jail will be applied toward his term, meaning that he will remain under supervision until mid-2026.

Provisions of the plea agreement require that Clark will be barred from using computers without permission and supervision from law enforcement.