Court documents show how FBI used a leaked copy of the OGUsers forum database, user details from Discord, and data from Coinbase to track down Twitter hackers
A timeline of the Twitter hack composed from court documents published today. — After earlier today US law enforcement charged …
Context & Ripple Effects
The FBI's charges close out the investigation of the July 2020 Twitter hijacking, in which an attacker apparently reached the company's internal dashboard through credentials pinned in a Slack channel. What makes today's disclosure notable is the method: investigators stitched together a leaked copy of the OGUsers forum database with Discord account details and Coinbase transaction records to unmask suspects who never touched Twitter's own logs.
The case sits inside a longer arc where hacker-community databases keep leaking into rivals' hands — the Cracked.to member dump posted on Raidforums was an early example — turning forum membership itself into a de-anonymization risk that law enforcement can mine years later.
First-order effects
- The named suspects are now identified via court documents, with the FBI demonstrating that a leaked OGUsers database plus Coinbase KYC-style records were enough to bridge pseudonymous handles to real identities.
- OGUsers members face immediate exposure: their own forum's leaked user table is now documented as an investigative source.
Second-order effects
- Platforms moved against the forum ecosystem within months — Facebook, Instagram, TikTok, and Twitter ran coordinated action seizing hundreds of accounts tied to top OGUsers members — a direct knock-on from the same community being mapped.
- Hacker forums become a liability chain: each leak of one community's database arms investigators and rival sites alike, pressuring operators toward tighter opsec or migration to newer venues like BreachForums.
Third-order effects
- If the pattern holds, criminal forums structurally decay faster: leaks cascade between rival sites and law enforcement builds standing pipelines over exchange and platform data, as the FBI's later seizure of BreachForums shows the state escalating from mining these communities to shutting them down outright.
- Crypto exchanges' identity records harden into default investigative infrastructure, meaning any pseudonymous actor who touches fiat rails inherits a durable de-anonymization surface regardless of operational security elsewhere.
The trend: Law enforcement is institutionalizing cross-source de-anonymization — fusing leaked forum databases with platform and exchange records — which is steadily eroding the safety of pseudonymous participation in cybercriminal communities.