Graham Ivan Clark | |
|---|---|
 Booking photo from July 2020 | |
| Born | Graham Ivan Clark (2003-01-09)January 9, 2003 (age 22) Tampa, Florida, U.S. |
| Other names | Kirk, OpenHCF, Open, Scrim, Feed, Graham$ |
| Known for | 2020 Twitter bitcoin scam |
| Criminal status | Released |
Graham Ivan Clark (born January 9, 2003) is an Americancomputer hacker,cybercriminal and a convicted felon regarded as the main perpetrator behind the2020 Twitter account hijacking.
Graham Ivan Clark grew up inHillsborough County, Florida, with his mother, father, and older sister.[1] His parents divorced when he was 7; as of 2020, his father lives inIndiana.[2] During his teenage years, Clark used various aliases while participating in online communities, gaining notoriety as a scammer in the "hardcore factions"Minecraft community.[2] In 2018, Graham joinedOGUsers, a forum dedicated to selling, buying, and trading online accounts, and was banned after four days.
In 2019, at the age of 16, Clark was involved in stealing 164bitcoins from Gregg Bennett, aSeattle-basedangel investor, through aSIM swap attack. Clark sent two extortion notes under the alias "Scrim", stating, "We just want the remainder of the funds in the Bittrex", referring to thecryptocurrency exchange "Bittrex" that Bennett had used, and "We are always one step ahead and this is your easiest option." TheUnited States Secret Service managed to recover only 100 bitcoins from the heist.[3] In an interview, Bennett said he was told by a Secret Service agent that the person with the stolen bitcoins was not arrested because he was a minor.[2]
Clark is widely regarded as the "mastermind" of the2020 Twitter account hijacking,[4][5] an event in which Clark worked with Mason Sheppard and Nima Fazeli to compromise 130 high-profileTwitter accounts to push a cryptocurrency scam involving bitcoin along with seizing "OG" (short fororiginal) usernames to sell on OGUsers. At the time, Sheppard was 19, Fazeli was 22, and Clark was 17. Sheppard and Fazeli specialized in playing the role of brokers in selling theTwitter handles on OGUsers.
The Twitter hack began on June 14 when Sheppard and Fazeli assisted Clark in manipulating employees throughsocial engineering.[6] This involved calling multiple Twitter employees and posing as the help desk in Twitter's IT department responding to a reported problem with Twitter's internalVPN. From there, Clark directed the employee to aphishing site that was identical in appearance to Twitter's VPN log-in portal. When the employee entered their information into the phishing portal, the credentials were simultaneously entered onto the real log-in page. After one employee account was compromised, it was used to review instructions on Twitter'sintranet on how to take over Twitter accounts.[7]
On July 31, 2020, Clark was arrested at his home inNorthdale, Florida. He faced 30 criminal charges, including 17 counts ofcommunication fraud, 11 counts of fraudulent use of personal information, one count of organized fraud for more than $5,000, and one count of accessing a computer or electronic device without authority. His bail was set at $725,000 and he pleaded not guilty. His hearing was held on March 16, 2021, viaZoom at Hillsborough County Jail. He was sentenced to three years in prison followed by three years of probation as part of aplea deal under Florida's Youthful Offender Act, which limits the penalties for convicted felons under the age of 21.[8] According to theTampa Bay Times, he was able to serve part of his time in a military-styleboot camp.[9]
The plea agreement[10] stipulated that Clark could not "direct[ly] or indirect[ly] access" any electronic device without both the express permission of his probation officer and the notification of theFlorida Department of Law Enforcement. He was also required to provide a list of "any and allelectronic mail addresses, Interactive computer services, Internetdomain names, commercial social networking websites, online or remote storage and computing devices, Internet identifiers and each Internet identifier's corresponding website [sic] homepage or application software name; home telephone numbers and cellular telephone numbers in his care custody or control." Additionally, he was ordered to disclose passwords, security codes,tokens, andkey fobs.[11]
Clark was released from Saint Petersburg Community Release Center on February 16, 2023. He is currently under probation until February 15, 2026.[12]