Twitter says 130 accounts were targeted in a major cyber-attack of celebrity accounts two days ago.
However, Twitter says only a “small subset” of those 130 accounts had control seized by the attacker.
The security breach saw accounts including those of Barack Obama, Elon Musk, Kanye West and Bill Gates tweet a Bitcoin scam to millions of followers.
Twitter said it was still trying to work out if private data – which could include direct messages – was stolen.
“We’re working with impacted account-owners and will continue to do so over the next several days,” the company said, through its official support account.
“We are continuing to assess whether non-public data related to these accounts was compromised,” it added.
The FBI is now investigating.
On 15 July, a number of Bitcoin-related accounts began tweeting what appeared to be a simple Bitcoin scam, promising to “give back” to the community by doubling any Bitcoin sent to their address.
Then, the apparent scam spread to mainstream celebrity accounts such as Kim Kardashian West and former vice-president Joe Biden, and those of corporations Apple and Uber.
Twitter scrambled to contain the unprecedented attack, temporarily preventing all verified users – those with a blue tick on their accounts – from tweeting.
Attackers were able to bypass account security because they had somehow gained access to Twitter’s own internal administration tools.
However, US President Donald Trump, one of the most prominent Twitter users, was unaffected.
There has been speculation for some time that President Trump has extra protections in placeafter his account was deactivated by an employee on their last day of work in 2017.
The New York Times confirmed that was how Mr Trump’s account escaped the attack, citing an anonymous White House official and a separate Twitter employee.
Despite the fact that the scam was obvious to some, the attackers received hundreds of transfers, worth more than $100,000 (£80,000).
What do we know about the attackers?
Bitcoin is extremely hard to trace and the three separate crypto-currency wallets that the cyber-criminals used have already been emptied.
The digital money is likely to be split into smaller amounts and run through so-called “mixer” or “tumbler” serv