Hacker behind Obama X breach ordered to return $5.4m in bitcoin

Joseph James O’Connor, convicted for his role in the 2020 Twitter hack, has been ordered to repay £4.1 million (US$5.4 million) worth of Bitcoin under a civil recovery order obtained by British prosecutors.

O’Connor, 26, pleaded guilty in the US to charges including computer intrusion, wire fraud, and extortion, and was sentenced to five years in prison in 2023.

He was arrested in Spain in 2021 and extradited to the US after the country’s High Court ruled the evidence and victims were there.

Britain’s Crown Prosecution Service obtained a civil recovery order to seize 42 Bitcoin and other cryptocurrency assets linked to the scheme, which used hijacked accounts to solicit cryptocurrency and threaten celebrities.

The assets will be liquidated by a court-appointed trustee.

The July 2020 attack compromised accounts belonging to Barack Obama, Joe Biden, Elon Musk, Bill Gates, Warren Buffett, and Kim Kardashian, prompting Twitter (now X) to temporarily restrict verified accounts.

🔗 Source: Reuters

🧠 Food for thought

Implications, context, and why it matters.

£4.1m seizure tops prior estimates, restitution still uncertain

The UK civil recovery order against Joseph James O’Connor covers £4.1 million in cryptocurrency 1. He stole about $794,000 through SIM swapping (a phone-number hijacking tactic), and the bitcoin scam raised over $117,000 in total 2.
O’Connor agreed to forfeit more than $794,000 and to pay restitution in the U.S. case 3. How the £4.1m order fits with total proceeds, and whether victims see more than prior forfeitures, remains unclear.
UK proceeds-of-crime law permits seizure even when conviction happened abroad 1. The Crown Prosecution Service (CPS) returned £95 million to victims out of £478 million in five years 1, so many may wait years or receive only part of their losses.

X security key migration failure renews push for phishing-resistant authentication for enterprise social teams and high-profile accounts

X locked out security-minded users in November 2025 during a move of security keys from twitter.com to x.com 4, as many had to re-enroll and hit “endless loops” if they used hardware keys (people who use physical authentication keys).
The 2020 breach used social engineering (tricking employees) to reach internal admin tools 3, which exposes weak employee credential protection as the main gap for social platforms and enterprise IT teams that run high-value accounts.
Demand is rising for FIDO2 hardware keys, passkey solutions (passwordless sign-in using device-based cryptographic credentials), and SIM-swap defenses (measures to prevent phone-number hijacking). X removed SMS two-factor authentication (2FA) for non-Premium users in 2023 5. Enterprises that manage celebrity, executive, or brand accounts need training and phishing-resistant authentication that survives migrations without lockouts.