\u00a0\u00a0 <\/p>\n
[responsivevoice_button rate=”1\u2033 pitch=”1.2\u2033 volume=”0.8\u2033 voice=”US English Female” buttontext=”Story in Audio”]<\/p>\n
<\/p>\n
For Graham Ivan Clark, the online mischief-making started early.<\/p>\n
By the age of 10, he was playing the video game Minecraft, in part to escape what he told friends was an unhappy home life. In Minecraft, he became known as an adept scammer with an explosive temper who cheated people out of their money, several friends said.<\/p>\n
At 15, he joined an online hackers\u2019 forum. By 16, he had gravitated to the world of Bitcoin, appearing to involve himself in a theft of $856,000 of the cryptocurrency, though he was never charged for it, social media and legal records show. On Instagram posts afterward, he showed up with designer sneakers and a bling-encrusted Rolex.<\/p>\n
The teenager\u2019s digital misbehavior ended on Friday when the police arrested him at a Tampa, Fla., apartment. Florida prosecutors said Mr. Clark, now 17, was the \u201cmastermind\u201d of a prominent hack last month, accusing him of tricking his way into Twitter\u2019s systems and taking over the accounts of some of the world\u2019s most famous people, including Barack Obama, Kanye West and Jeff Bezos.<\/p>\n
His arrest raised questions about how someone so young could penetrate the defenses of what was supposedly one of Silicon Valley\u2019s most sophisticated technology companies. Mr. Clark, who prosecutors said worked with at least two others to hack Twitter but was the leader, is being charged as an adult with 30 felonies.<\/p>\n<\/div>\n<\/div>\n
Millions of teenagers play the same video games and interact in the same online forums as Mr. Clark. But what emerges in interviews with more than a dozen people who know him, along with legal documents, online forensic work and social media archives, is a picture of a youth who had a strained relationship with his family and who spent much of his life online becoming skilled at convincing people to give him money, photos and information.<\/p>\n
\u201cI knew he really wanted money and he was never in the right mind-set,\u201d said Colby Meeds, 19, a former friend in Minecraft who said Mr. Clark promised him $100 for his account but never paid up. \u201cHe would do anything for some money.\u201d<\/p>\n<\/div>\n<\/div>\n
Reached via a brief video call on Sunday from the Hillsborough County Jail in Tampa, Mr. Clark appeared in a black sleeveless shirt, his hair tumbling into his eyes. \u201cWhat are your questions?\u201d he asked, before pushing back his chair and hanging up. He is scheduled for a virtual court appearance on Tuesday.<\/p>\n
Mr. Clark and his sister grew up in Tampa with their mother, Emiliya Clark, a Russian immigrant who holds certifications to work as a facialist and as a real estate broker. Reached at her home, his mother declined to comment. His father lives in Indiana, according to public documents; he did not return a request for comment. His parents divorced when he was 7.<\/p>\n<\/div>\n<\/div>\n
Mr. Clark doted on his dog and didn\u2019t like school or have many friends, said James Xio, who met Mr. Clark online several years ago. He had a habit of moving between emotional extremes, flying off the handle over small transgressions, Mr. Xio said.<\/p>\n
\u201cHe\u2019d get mad mad,\u201d said Mr. Xio, 18. \u201cHe had a thin patience.\u201d<\/p>\n
Abishek Patel, 19, who played Minecraft with Mr. Clark, defended him. \u201cHe has a good heart and always looks out for the people who he cares about,\u201d he said.<\/p>\n
In 2016, Mr. Clark set up a YouTube channel, according to the social media monitoring firm SocialBlade. He built an audience of thousands of fans and became known for playing a violent version of Minecraft called Hardcore Factions, under user names like \u201cOpen\u201d and \u201cOpenHCF.\u201d<\/p>\n
But he became even better known for taking money from other Minecraft players. People can pay for upgrades with the game, like accessories for their characters.<\/p>\n
One tactic used by Mr. Clark was appearing to sell desirable user names for Minecraft and then not actually providing the buyer with that user name. He also offered to sell capes for Minecraft characters, but sometimes vanished after other players sent him money.<\/p>\n<\/div>\n<\/div>\n
Mr. Clark once offered to sell his own Minecraft user name, \u201cOpen,\u201d said Nick Jerome, 21, a student at Christopher Newport University in Virginia. The two messaged over Skype and Mr. Jerome, who was then 17, said he sent about $100 for the user name because he thought it was cool. Then Mr. Clark blocked him.<\/p>\n<\/div>\n<\/div>\n
\u201cI was just kind of a dumb teenager, and looking back, there\u2019s no way I should have ever done this,\u201d Mr. Jerome said. \u201cWhy should I ever have trusted this dude?\u201d<\/p>\n
In late 2016 and early 2017, other Minecraft players produced videos on YouTube describing how they had lost money or faced online attacks after brushes with Mr. Clark\u2019s alias \u201cOpen.\u201d In some of those videos, Mr. Clark, who can be heard using racist and sexist epithets, also talked about being home schooled while making $5,000 a month from his Minecraft activities.<\/p>\n Mr. Clark\u2019s real identity rarely showed up online. At one point, he revealed his face and gaming setup online, and some players called him Graham. His name was also mentioned in a 2017 Twitter post<\/a>.<\/p>\n Mr. Clark\u2019s interests soon expanded to the video game Fortnite and the lucrative world of cryptocurrencies. He joined an online forum for hackers, known as OGUsers, and used the screen name Graham$. His OGUsers account was registered from the same internet protocol address in Tampa that had been attached to his Minecraft accounts, according to research done for The Times by the online forensics firm Echosec.<\/p>\n Mr. Clark described himself on OGUsers as a \u201cfull time crypto trader dropout\u201d and said he was \u201cfocused on just making money all around for everyone.\u201d Graham$ was later banned from the community, according to posts uncovered by Echosec, after the moderators said he failed to pay Bitcoin to another user who had already sent him money to complete a transaction.<\/p>\n<\/div>\n<\/div>\n Still, Mr. Clark had already harnessed OGUsers to find his way into a hacker community known for taking over people\u2019s phone numbers to access all of the online accounts attached to the numbers, an attack known as SIM swapping. The main goal was to drain victims\u2019 cryptocurrency accounts.<\/p>\n<\/div>\n<\/div>\n In 2019, hackers remotely seized control of the phone of Gregg Bennett, a tech investor in the Seattle area. Within a few minutes, they had secured Mr. Bennett\u2019s online accounts, including his Amazon and email accounts, as well as 164 Bitcoins that were worth $856,000 at the time and would be worth $1.8 million today.<\/p>\n Mr. Bennett soon received an extortion note, which he shared with The Times. It was signed by Scrim, another of Mr. Clark\u2019s online aliases, according to several of his online friends.<\/p>\n \u201cWe just want the remainder of the funds in the Bittrex,\u201d Scrim wrote, referring to the Bitcoin exchange from which the coins had been taken. \u201cWe are always one step ahead and this is your easiest option.\u201d<\/p>\n In April, the Secret Service seized 100 Bitcoins from Mr. Clark, according to government forfeiture documents. A few weeks later, Mr. Bennett received a letter from the Secret Service saying they had recovered 100 of his Bitcoins, citing the same code that was assigned to the coins seized from Mr. Clark.<\/p>\n It is unclear whether other people were involved in the incident or what happened to the remaining 64 Bitcoins.<\/p>\n Mr. Bennett said in an interview that a Secret Service agent told him that the person with the stolen Bitcoins was not arrested because he was a minor. The Secret Service did not respond to a request for comment.<\/p>\n By then, Mr. Clark was living in his own apartment in a Tampa condo complex. He had an expensive gaming setup, a balcony and a view of a grassy park, according to friends and social media posts.<\/p>\n<\/div>\n<\/div>\n Two neighbors said that Mr. Clark kept to himself, coming and going at unusual hours and driving a white BMW 3 Series.<\/p>\n On an Instagram account that has since been taken down, @error, Mr. Clark also shared videos of himself swaying to rap music in designer sneakers. He was given a shout-out on Instagram by a jeweler to the hip-hop elite, with a picture showing that Mr. Clark, as @error, had purchased a gem-encrusted Rolex.<\/p>\n Mr. Xio, who became close friends with Mr. Clark, said the April run-in with the Secret Service shook Mr. Clark.<\/p>\n \u201cHe knew he was given a second chance,\u201d Mr. Xio said. \u201cAnd he wanted to work on being as legit as possible.\u201d<\/p>\n But less than two weeks after the Secret Service seizure, prosecutors said Mr. Clark began working to get inside Twitter. According to a government affidavit, Mr. Clark convinced a \u201cTwitter employee that he was a co-worker in the IT department and had the employee provide credentials to access the customer service portal.\u201d<\/p>\n For help, Mr. Clark found accomplices on OGUsers, according to the charging documents. The accomplices offered to broker the sale of Twitter accounts that had cool user names, like @w, while Mr. Clark would enter Twitter\u2019s systems and change ownership of the accounts, according to the filings and accounts from the accomplices.<\/p>\n<\/div>\n<\/div>\n The hack unfolded on July 15. A few days later, one accomplice, who went by the name \u201clol,\u201d told The Times that the person they knew as the mastermind began cheating the customers who wanted to covertly buy the Twitter accounts. The hacker took the money and handed over the account, but then quickly reclaimed it by using his access to Twitter\u2019s systems to boot out the client. It was reminiscent of what Mr. Clark had done earlier on Minecraft.<\/p>\n<\/div>\n<\/div>\n When Mr. Clark\u2019s online acquaintances learned he had been charged with the hack, several said they were not surprised.<\/p>\n \u201cHe never really seemed to care about anyone but himself,\u201d said Connor Belcher, a gamer known as @iMakeMcVidz who had previously teamed up on a separate YouTube channel with Mr. Clark before becoming one of his online critics.<\/p>\n Susan Jacobson contributed reporting from Tampa, Fla. Sheelagh McNeil and Jack Begg contributed research.<\/p>\n<\/div>\n<\/div>\n