Tampa teen pleads not guilty as documents reveal how feds cracked his Twitter hack case

TAMPA — Obscure social media platforms, a hacked database and drivers license photos.

These are the crumbs that led federal agents to the illegal sale of celebrities’ Twitter accounts — Joe Biden, Jeff Bezos, Elon Musk and Kanye West among them — and the arrest of a Tampa teen investigators call the “mastermind” of the operation, according to new court documents obtained by the Tampa Bay Times.

Graham Ivan Clark, 17, is accused of gaining access to the Twitter accounts and sending tweets soliciting others to send in payments of Bitcoin, the hard-to-track cryptocurrency that stores transaction data on the blockchain — a decentralized public ledger. Prosecutors say Clark promised any Bitcoin sent in would be returned doubled. In all, Clark reaped $117,000 over about three hours, prosecutors said.

Clark, 17, a student at Gaither High School until last January, pleaded not guilty to the charges Tuesday in Hillsborough Circuit Court. He is scheduled for a bail hearing Wednesday, where his attorneys will argue for reduced bail. He remains in jail on $725,000 bail. He faces 30 charges and, if convicted, could spend up to 200 years in prison.

Two other suspects face related charges in a California federal court — Nima Fazeli, 22, of Orlando, and Mason Sheppard, 19, of the United Kingdom. On the social media platform Discord, which has its roots in the world of online gaming, the two are known as Rolex#0373 and ever so anxious#001.

Fazeli and Sheppard operated as brokers for Discord user “Kirk#5270,” who claimed he worked for Twitter in private messages obtained by federal agents.

Kirk#5270 told the two he would access and take control of Twitter accounts in exchange for Bitcoin transfers. Fazeli and Sheppard agreed to post Kirk’s offer on OGUsers, a forum and marketplace popular with hackers.

The federal charges don’t identify Kirk#5270 and the U.S. Attorney’s Office in the Northern District of California declined to provide a real name to the Times. Graham Clark, the Tampa teen, does not appear by name in the federal charges.

The Juvenile Delinquency Ac, a federal law, favors referring juveniles to state court, especially in cases that don’t involve violent or drug-related crimes.

OGUsers, it turns out, was hacked in April, and its data was posted on the internet — public forum postings, private messages, internet addresses and email addresses. The FBI downloaded the data and agents tracked accounts linked to Fazeli and Sheppard.

Want breaking news in your inbox?

Subscribe to our free News Alerts newsletter

You’ll receive real-time updates on major issues and events in Tampa Bay and beyond as they happen.

Loading...

You’re all signed up!

Want more of our free, weekly newsletters in your inbox? Let’s get started.

Explore all your options

They found transactions made by the two over Coinbase, a cryptocurrency exchange. Coinbase provided agents photos of drivers licenses belonging to Fazeli and Sheppard, one from Florida and one from the United Kingdom. Coinbases requires photo ID to confirm account holders’ identities.

Fazeli faces a charge of computer intrusion, punishable by up to five years in prison and a $250,000 fine. Sheppard faces charges of computer intrusion, conspiracy to commit wire fraud and conspiracy to launder money, which collectively are punishable by up to 45 years in prison and a $750,000 fine.

Last week’s arrest was just the latest in a series of accusations that Clark has stolen Bitcoin, according to documents in his Hillsborough circuit case. Clark was the subject of an investigation last year involving prosecutors in Hillsborough County and Santa Clara, Calif.

No charges resulted, but in April, Clark surrendered $900,000 worth of Bitcoin to victims, Hillsborough prosecutors said in court documents filed with the Twitter case. The remainder of Clark’s Bitcoin balance was frozen for 11 days, then he transferred it to a different account “in an effort to disguise his new criminal ventures,” prosecutors wrote.

Clark faces 17 counts of communications fraud, 11 counts of fraudulent use of personal information, one count each of organized fraud over $5,000, and accessing a computer or electronic device without authority.