Hacked - Open Secret

Episode Date: July 16, 2022

The story of a Minecraft scammer who sort of hacked the President.  Like Hacked? Subscribe, spread the word, and visit https://www.patreon.com/hackedpodcast to show us some love. Learn more about your ad choices. Visit podcastchoices.com/adchoices

All right, what's up guys? It's a me, Lord here. This video is about a scammer, a liar, and just someone that is pretty scummy. You guys probably know them already. It's Open. So this all starts on Minecraft. Oh, I love it already. Back in 2016, there was this Minecraft player named Open. And Open started to get some flack in the Minecraft community. Take this video from Mizoid, for example.

They work together and they scam like mine gun capes. Like they sell mine gun capes and it's a scam. They did it to me. The deal was I'd give them $50 and a shoutout for a mine gun cape. Open had been scamming people, basically saying, I will trade you this rare item for some cash and a shout out. And the only reason his victims like Mizoid believed the scam was because Open had a bunch of YouTube.

He was a streamer who played this super violent variation on Minecraft called Hardcore Factions. But as Mizoid explained, I only believed it because of his YouTube channel because he has subs, but the thing is, all of his subs are because he fakes his giveaways. So Mizoid decided to record open, and we can hear him pulling this scam. I'll give you the code, I'll give you the link first, and then I'll do the... the word to email. Okay.

I'm recording this right now. Okay. Me too. All right, that's the redeem. Just as quick as Open shows up. User disconnected from your channel. What a good guy. And Open is gone.

Open is a story not because of how his career as an internet grifter began, which was, you know, we think right here on Minecraft. Open is a story because of where his career, his career as a grifter and later hacker would go, which is on to becoming the main character in an international news story that involved Elon Musk, Joe Biden, Bill Gates, Barack Obama, Jeffrey Bezos, some of the most famous people in the world. There are multi-thousand-word New York Times profiles on Open and segments on just about every

news broadcast in the West on his crimes and eventual arrest. Open is in jail right now. He will be for another year or so, but he was a minor when he did the stuff he was charged with, so we're going to avoid using his legal name, though it is very, very well documented. But the thing that I find really interesting about this story is the way that his career as a hacker both evolved

and also kind of stayed the same. Because the hack that would land him in prison, the hack that had him penetrating the very sophisticated, security of a large technology company was kind of just a super involved, elaborate version of the same thing he was doing here as a kid on Minecraft, the same thing he did to mesoid, conjuring up some internet clout and using it to get folks to send him something in exchange for something he was never going to send them. This is the open secret here on Hacked.

I got to assume he's big into Bitcoin. Oh man, you're going to like this. Because if you love a Gryft, like how can you not love Bitcoin? Well, it's also very useful for a Gryft. That's going to come back in a big way. You predicted something on that one. So how are you doing, Scott? I'm good.

How are you doing, Jordan? I'm doing good. Keep him busy. A point of note. I will be out of the country for a few weeks, so I will maybe be missing an episode. So I apologize to everybody in advance. And I apologize to you leaving you here alone, even though we all know that you're much better at this. As untrue, the people, we'll all miss you here at Hacked Scott, but we'll have you back soon.

But before you go, I know you probably want to give a big old shout out to our new patrons on Patreon. I love our new patrons, all of them. Patreon.com slash hacked podcast. Welcome. Thank you for your support. It means a lot to us. We'll say hi to you at the end of this show. So there's two parts to this story.

First is Open's career leading up to the big hack that landed him in jail. And then there is the story of the hack itself. And we're going to start with, you know, everything that led up to that. Open grew up as like a normal kid in Tampa with a sister and his mom. His parents divorced when he was seven. His footprint online, however, starts when he's about 10 years old and he starts to play Minecraft. If my math is right, that video we heard in the intro, he would have been about 13, maybe 14 years old. Open's reputation on Minecraft had like two big elements to it.

He was like kind of a grifter and he had a reputation as being a pretty like angry dude online. To start with his grift, it didn't typically involve rare items. involve rare items like the MineConcape. He didn't use those as his bait. The commodity that Open liked to use was rare usernames. For starters, his, open. He got his hands on others to feed, I think, was one of his. I can't pretend to know what was going on in his head, but it's hard not to look at this whole story zoomed out everywhere it goes and wonder if it all started with the fact that he got a good username when he was a kid. So wait. So he'd be. began his like online presence and online in like a very enterprising way.

Like he was essentially doing domain squatting but on usernames. Is that essentially what you're saying? Domain squatting is usernames. Look, we talk a lot about usernames in this episode. Domain squatting is a really, really good analogy. Like he got a high clout, like kind of name you want. And that was his commodity. That was what he bought and sold.

That was what he traded in. Interesting. Because people wanted that username and it had some value. And he kind of figured that out. Well, not even that. If you've used a username on one system, you obviously want it on other systems. Bingo. You could even, you know, just like they do with domain squatting,

you could probably write an algorithm that takes care of it for you. And you could bill everybody five bucks to get their usernames, and it would be a huge nightmare. And you'd probably cause a bunch of policy legislation on, you know, terms and conditions on websites in the future, but whatever. But the best insight. we have into those early days is he would just run this like same kind of hustle over and over again like oh you want my username oh you want this thing send me this or do this and it's yours and then he

would just vanish over and over again permutations of the same thing which i find very interesting he found that scam very young the other part of his reputation on Minecraft and kind of in real life was he seemed to a bunch of folks that have been interviewed about him since his arrest like kind Kind of just an angry dude, like a kid with a temper. A defining trait of a lot of the YouTube content he would churn out after starting his channel in 2016, in 2016, was he would just fly off the handle of people. And there's like internet, streamer, YouTube thumbnail angry. And there's what his friend James Joe described as like, he would get mad, mad.

Like the streamer, oh my God, I can't believe this happened mad. And then there's just angry. And Open would just get angry. and he would kind of act fast based on that angle. He would fly off the handle a little bit, and I think that impulsivity is important for this story. After a while, Open is growing up. His interests start to drift away from Minecraft.

For a little while, he gets into the Fortnite community, but the next big online space that he finds is not a game. It's this place called OG users. Have you heard of OG users, Scott? I haven't. Oh, it's interesting. I don't think we've talked about it before. There's a really good reply-all episode that spends a lot of time there.

But it's kind of just this classic old-school ugly hacker forum, just like a basic-looking message board, some Discord channels blooming out of it. But the thing that they specialize in OG users, the commodity in the middle of it, is what they call OG handles, really flashy, cloudy usernames. which our boy Open has some experience in. Totally. And like you said, it kind of becomes about stealing those cool usernames.

Not just buying and selling them, but how you get them from people that already have them. How to do it, how to hack people for their cool usernames, and how to sell them anonymously. What starts as this community all about these cool flashy usernames becomes a hacking forum dedicating to stealing people's accounts, not to take money from them, but to have their good usernames. In 2017, Open signs up for an OG users account. According to the online forensics firm Ecosack, he does so from the same IP address where he signed up for a Minecraft account as a 10-year-old, presumably in his childhood bedroom. Would you like to know what a 15-year-old Opens bio on OG users was.

I would love to know. I don't even want to try and guess. It's very like hustle culture. It's like it's very internet Bugatti vibes. I think I'm going to like it. Crypto, crypto, bro. Glambos over love. 15 year old Open describes himself as quote, full-time crypto trader dropout, focused on just making money all around for everyone. Wow, nailed that. You called that one a mile out. And Open immediately tries to run a variation on his typical hustle.

He tries to offer to sell something to someone and then not give it to them. But for the first time, he is not dealing with Minecraft users. He's in a hacking forum. So he's immediately banned from the community, according to some posts uncovered by that firm ECOSEC. After some moderators said he failed to pay another user some Bitcoin who had already sent him to complete a transaction. But he had found his way into a community of people who were really up to a much more advanced version

of the same thing he'd been onto since he was like 13. People blurring that line between internet clout and real commodities you can buy sell and steel and willing to kind of hack and dig into stuff to make money in that fuzzy space in between. Open used a bunch of aliases online, obviously one of which is open, most of which we're not using here to keep this followable. But there's one other one we will mention.

He went by the name is Scrim. Because Scrim is the name he uses when he shows up again in 2019. His next big appearance. For two years or so, he has been descending into this OG user's online community. And when he pops back up again, his scam has, as it tends to, both stayed the same and evolved. In 2019, a guy named Greg Bennett gets his phone hacked using a little thing

that we have talked about here before called a sim swap. Broadly speaking, what is a sim swap? Well, Jordan, I feel like this is that moment in the movie where we like cut out and we go to somebody else who's like sitting in a pool. I'm going to explain something to you. Yeah, 100%. Big Short.

Exactly. I'm glad you got the reference. A sim swap is essentially when you clone a sim or cause a sim's universal ID number to go to a new sim to allow communications going to the original device to come to your device. And this is used to bypass two-factor authentication and other various things. You know, also just to pose as a person and be able to communicate as them, which, you know, is wonderfully powerful in social engineering. But I think that's probably the nitty gritty of it. That's the nitty gritty. So Greg Bennett, a Seattle technology investor, gets his phone hacked via SIM swap.

And within a few minutes, the hacker had secured Mr. Bennett's like all of his accounts, his Amazon, his email, as well as a crypto wallet with 164 bitcoins that at the time was worth a little $5 a million bucks. Yeah. And then he gets a note from the hackers saying, we just want the remainder of the funds in BitTrecks. We are always one step ahead. and this is going to be your easiest option. Signed, scrim. I won't get into how Open was caught, like how he got caught doing this,

because this one is a lot less documented a crime than his next one, but it is Open's first encounter with law enforcement. According to government forfeiture documents in April of the same year, the Secret Service seized 100 bitcoins from Open. They had found him. A few weeks later,

Mr. Bennett gets a letter from the Secret Service informing him that they had regained 100 of his Bitcoins. And when Bennett asked them if anything was going to happen to the person who'd stolen the coins, they said no, because he's very much still a minor at this point. I think 16 may be about to turn 17. A minor who had stolen the better part of a million dollars, but a minor nonetheless. So what we know is that Open, according to folks that knew him, was pretty startled by this whole thing. But that was at odds with the fact that he was still making money doing this kind of stuff.

He was by this point, I guess, living on his own. It's hard not to look at this and see this is the point where stuff could have forked for him. Right. According to his friend James Joe, who we quoted earlier, you know, like shockingly, he was pretty shaken by the Secret Service coming and reclaiming almost a million bucks he'd taken. But he was living in a condo in Tampa. Like, Lord knows what he did to get that least signed as a minor. He had a flashy gaming rig in a balcony with a nice view of the park. His namers said that he drove a beamer.

His Instagram showed him starting to get into sneakerhead stuff. He'd had this close run in with the law, but he'd made it out alive, and he was kind of doing well otherwise. So he made decent money in the username scams. And increasingly just the hacking people world. Oh, of course, of course. And I don't know how a guy this young with no other experience or way to make money except what he'd been doing keeps this whole lifestyle going. So that path does not fork. It forges ahead in a pretty spectacular fashion.

And Open comes up with his next big scheme. And it starts just a few weeks later when an employee at Twitter got a message from someone claiming to be a co-worker in the IT department. asking the employee to provide some credentials to access the backend customer service portal. Open had decided to hack Twitter. Wow. What would go on to be the great Twitter hack of 2020. That had the Twitter accounts of Joe Biden, Elon Musk, Jeff Bezos, some of Twitter's biggest users, posting tweets, hawking crypto. Oh, I remember this.

After the break. Think about the last time you heard a breach story on this show. It always starts the same way. Someone, somewhere, saw something too late. An alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora Super Intelligence Platform, a fully agenetic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic.

agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy. And all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than nine trillion telemetry events every week and over a decade of real world incident response. The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora agent SOC. It's the first SCC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts.

Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision reflects your environment instead of generic assumptions. The automation frees your concierge, security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy production-ready AI and security operations actually looks like, go to arcticwolf.com slash hacked. Never feel like cyber threats are evolving faster than anyone can keep up? Last year,

2025 was nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head. Or, Organizations around the world saw headlines they never expected and cybersecurity teams were tested like never before. But here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th, diving the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded. And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights into how threat actors are evolving.

how defenders are responding and what strategies can help you stay ahead of the next big breach. It's not fearmongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. I remember when all these things happened.

Joe Rogan, like I think it was like a bunch of these like huge Kanye West. Yeah. Like ultra high profile accounts. I think the president wasn't, didn't the president posted? Yeah. Oh, everybody. about like essentially like a crypto grift.

It was a crypto grift. And it feels like a long time ago, but it was like a really, really big story when it happened. People thought it was like a nation state level attack because the president was tweeting about crypto. I do remember this. It does feel like it was so long ago,

but 2020 wasn't that long ago. That's like a pandemic away. Exactly. Yeah, that's fascinating. Okay, great. I love this. Yeah. It seemed like such a big thing when it was happening, and the truth is so much dumber.

I'm not saying the people who did it were dumb, but what they did with the amount of access they got, considering how catastrophically and publicly this blows up, it's very, very silly. I remember when this happened. I remember mentally thinking, what a strange way to leverage all that power. Like, I remember being like,

you've just taken control of like literally an infinite audience and what you do with it is like promote crypto. It's like breaking into Fort Knox and stealing the pens. Like it's just, it's really, it's like breaking into a casino and stealing the cutlery. It's like breaking into the Louvre and stealing from the gift shop. I wrote so many of these, man.

Yeah, that's good actually. Breaking into the Louvre and stealing from the gift shop. Feeling like a tiny little monolese painting. Like a cup with it on it. It's unclear exactly how Open managed to work his way up from this initial breach all the way to the tool set he would end up using to do this. But the best info suggests that the initial credentials he got were actually access to an internal Slack channel,

where somewhere in there somehow posted a username or a password kind of constituted enough of a foothold into their system that he was able to start climbing. Twitter's internal investigation said he then used a phone like spearfishing attack to pass some two-factor authentication on those credentials. But the exact steps of what he did are still kind of foggy. But what we do know is in May 2020, one of Opens eventual accomplices, Loll, gets a message from someone going by the name Kirk, who, authoritative. now believe was actually open.

Law was from the OG users community where Open hung out. That's where, you know, his alter ego, Kirk, reached out to Law. And Law gets a message that reads, yo, bro, I work at Twitter, don't show this to anyone seriously. The account an alias Open was using, you know, Kirk, had been created the same week he started reaching out to Lull and the other accomplices in the Twitter hack. They didn't know they were talking to Open

who was prominent in the OG users community. He was going incognito in his own ecosystem for this one. Yeah. Over the next day, Lull decides there's no way Open slash Kirk works at Twitter. He was too willing to mess with the company. He seemed kind of young. But he did believe that Open had the access he claimed to have. Open had proven it by actually going in and adjusting settings on their Twitter accounts.

He proved he had control of some very high level tools capable of giving him access to even the most sensitive Twitter accounts. as we've said it is buck wild to think about what someone sort of going a little bit more slowly and a little less impulsively could have done with that power Yeah seriously

But Open went straight to what he knew He had a plan and it was a plan to make a buck fast Grifting Gifting Open gets lull and some other guys named Anxious and Rolex together in a discord and he makes them this proposal He wants them to be his

middlemen on OG users. Open was going to use his Twitter backend access to steal the commodity that he knew, OG usernames, flashy cool usernames that that community would pay a bunch of money for, and Loll and the gang were going to be his middlemen to sell them to folks on the forums. Open does the stealing of the accounts using his access. They do the selling. Open takes a cut, and they all say, sounds good. You got a deal. And one of the first transactions, Loll brokered a deal for someone who paid $1,500 in Bitcoin for the username at Y. The money, later forensics would show, went to the same Bitcoin wallet that Open was later using. The group posted an ad on OGusers.com offering Twitter handles in exchange for Bitcoin.

Ever so anxious, one of his accomplices even got in on the thing. He got the screen name at anxious that he clearly really liked. And as the morning goes on, customers start seeing. this traffic, this new person selling, and they start coming in. And the prices that Open was asking for start to kind of creep up. And while he's hawking these names, he's also demonstrating to folks just how much access he has to Twitter's back end. You could really mess with the fundamental security settings on just about anybody's names and sent out pictures on the forums of Twitter's internal dashboard as proof that he had all of this power and control. People are watching,

he's showing off as this new username is puppeting Twitter like he developed it. And he's doing all of this to buy and sell usernames. Over this little spree, the crew took control of hundreds, at dark, at the letter W, the letter L, at number 50, at vague, really good usernames. You're just selling off dozens of them. So the scam is going well. They're moving these OG usernames, the day is winding down, and a few members in different time zones say, okay, we got to call it. It's the middle of the night here. We got to go to sleep.

And they all log off. And while they're gone, open, is still at it. And he eventually comes up with this new idea, something that requires no middleman, something that he thinks is going to be untraceable, and is really, he thinks, going to make this all worthwhile. At 3.30 p.m. that day, some of the biggest cryptocurrency companies in the world, starting with CoinBron, base, start tweeting variations on the same message. That is a charitable response to COVID-19. They would be making a match donation to the donor. Like if you sent them crypto, they would send it back doubled, just to help people out.

The tweets all read, all Bitcoin sent to the address below will be sent back doubled. If you send $1,000, I will send back $2,000 and then a link to a crypto wallet. Oh my God I remember this They all start tweeting it Or rather Open controlling their accounts Starts tweeting it

A minute after the first one goes public Loll gets a message on Discord from Open saying we just hit Coinbase And quickly Crypto starts to come in He grabs control of a selection of high follower accounts As you mentioned Joe Biden

Barack Obama Musk Conier Bill Gates Bezos Mike Bloomberg, Warren Buffett, Floyd Waymether, Kim Kardashian, the official accounts for Apple and Uber, all of them posting that same message in a flurry of, you know, copy paste, copy paste. Send Bitcoin to a specific account, and we'll send back your money doubled. Overall, open to control of 130 accounts and tweeting from about a curated set of 45. He was able to download some kind of undisclosed private data from 8 to 8.

the accounts, which considering the sensitivity of some of those accounts is a mystery I have not really seen looked into. When At Anxious woke up just after 2.30 a.m. in Britain, he looked online, saw what had happened, and sent a disappointed message to his other middleman lull, saying, quote, I'm not sad, I'm more just annoyed, because from all of this, he only made 20 Bitcoin, referring to Kirk's Bitcoin profits from the scam, which had him basically hacking the president, and only translated to about $180,000. Yeah, it seems like a light payout.

It's a lot of money, but not for what they did. I feel like just the access to people's DMs alone. Mm-hmm. Like, if you know what Elon Musk is up to with his stock portfolio, you could make way more than $180,000 at that. Yeah. You have so much intel. Like, just the sheer value of the information would have been,

so much more valuable. I know. Then flogging something that everybody instantly knew was just scam bait. Instantly. Instantly knew. Yeah, I don't want to tell people how to do crimes better, but like,

dude, extortion. You didn't do a good, you did such a good job, and then you just whifted it at the finish line. Like, you got into Twitter, and then you did this with it. Yeah. The infrastructure of the scam

huge, impressive. Yeah. The execution of it. Not creative. You know? By that point, Open had stopped responding to his middleman. He'd gone offline, he'd disappeared. And the world was just sort of watching

as seemingly the biggest users of one of the most influential social networks had all been hacked. And the speculation as to who did it kicks off. The day following, Twitter filed a formal criminal complaint with the authorities, and the FBI and Secret Service immediately start an investigation. Based on court documents, we know that the FBI started looking at data shared on social media and by some news outlets to work their way back to chat logs and user details from Discord. OG users was hacked back in April of 2020, and so the FBI was able to get a copy of the OG Usam's forum database from that leak. the database contained details on registered form users, emails and IP addresses, and some private messages.

Then, working with the IRS, they were able to obtain data from Coinbase about the Bitcoin addresses involved in the hack, as well as like crypto addresses used and mentioned by those three hackers in the Discord channels from the leaked OG users data. All they had to do then was just triangulate and correlate that data from those three sources. track the hackers' identities on the three sites, link them to the IP, and email addresses from the leak. Authorities didn't initially link open directly to the Kirk Discord user, but a few weeks later, July 31st, three different U.S. government sources published reports saying they had corroborated it. Not Russia, not China, not a nation state, but a 17-year-old from Tampa, who went by the name Open on Minecraft, was the mastermind of the 20th.

2020 Twitter hack. And he did it all to sell swaggy usernames and hustle for crypto donations. Open was arrested and in 2021, then 18 years old, he was sentenced as a youthful offender, avoiding the minimum 10-year sentence that would have followed if he'd been convicted as an adult. His middleman, lull, anxious, and Rolex

were all charged with federal crimes related to the scheme. I said this at the start, but the thing that I found interesting about all this was like the consistency of the, of his hustle, even as the scale grew and grew and grew. It always had to do with clout, the clout of a flash username, the clout of a high-profile Twitter account with some trust. At age 18, he finally goes down for a very involved version of the same kind of thing he

was pulling on mesoid when he was 13. And like that part of the story, the mesoid video we opened with, this all ends with this very timely 2020 internet live stream. A hacker hearing hacked. Except this time of a court trial because he was going through court during COVID, during the dawn of Zoom trials. Before they knew that you really needed to password protect those things. Today, the attorney for the Tampa teenager accused of taking over Twitter accounts of

world famous people tried to get his client's bond slash to get the alleged hacker out of jail. But people kept breaking into the video conference, disrupting, even shutting the hearing down at one point. This is audio from his sentencing appearance before a judge. You can hear it being interrupted with people zoom bombing in. But the hearing was hijacked by people who sought to repeatedly interrupt Judge Christopher Nash and attorneys as they talked about the accused Twitter hacker mastermind. Someone comes in and starts playing music over a lawyer. Someone screenshers and start streaming porn, obviously. And I like to imagine

they're his buddies from OG users coming in to say hi. Or maybe it's the people he was scamming on Minecraft. Maybe it's mezoid, checking in on his old pal. Thanks for listening, everybody. Big old shout out to our new patrons on Patreon. That's patreon.com slash hacked podcast.

As always, just a very great way to support the show. Jonas DeFrize. DeFri. DeFri. Thank you. House Lady 7. Thank you.

Lucas. Thank you. Noco. Noco. Thank you. Danny. Thank you very much. Thank you from the bottom of our hearts.

We really appreciate your support as we continue to tell weird tech tales. It means a lot to us. Thank you for making it to the end of another one of these bad boys and coming to the end credit music where we just like to have. hang out after the story is done. This is another one in the bucket. We'll catch you in the next one.