Court documents show how FBI used a leaked copy of the OGUsers forum database, user details from Discord, and data from Coinbase to track down Twitter hackers
A timeline of the Twitter hack composed from court documents published today. — After earlier today US law enforcement charged …
Context & Ripple Effects
The court documents arrive two weeks after the July 2020 Twitter breach, in which a person involved may have reached the company's internal dashboard through credentials pinned in a Slack channel. What makes this timeline notable is not the intrusion itself but the identification trail: a leaked copy of the OGUsers forum database, Discord user details, and Coinbase records let investigators connect handles to real identities.
The method has a lineage in the corpus. A year earlier, a Cracked.to database was posted at rival Raidforums, exposing users' IPs, emails, and DMs — showing that hacking forums are chronically vulnerable to having their own membership rosters turned into evidence. The OGUsers community would later face direct pressure, with Facebook, Instagram, TikTok, and Twitter seizing hundreds of accounts in a coordinated takedown of its top members.
First-order effects
- The hackers charged today lose their handle-based anonymity: the leaked OGUsers database plus Discord and Coinbase records gave the FBI a cross-platform identity map that no single service could provide on its own.
- Coinbase and Discord are now documented as evidentiary sources in a federal case, meaning their user data pipelines are part of the public record of how attribution happens.
Second-order effects
- Hacker-forum members face compounding exposure: the same leak-and-rival-posting dynamic seen when Cracked.to users' IPs and DMs surfaced on Raidforums means joining one forum can deanonymize participation across others.
- Platforms that hold financial or identity signals — exchanges like Coinbase especially — become de facto investigative chokepoints, raising the cost of transacting under a criminal persona.
Third-order effects
- If the pattern holds from OGUsers takedowns through the later FBI seizure of BreachForums, the forum layer of the criminal economy gets squeezed toward smaller, closed channels — while law enforcement institutionalizes 'leak forensics' as a standard attribution technique.
- For companies like Twitter, the case underscores that insider-access paths such as pinned Slack credentials matter as much as external defense, pushing internal credential hygiene onto the security agenda.
The trend: Attribution is shifting from technical forensics alone toward assembling leaked community databases and platform records, steadily eroding the anonymity that underground forums were built on.