The Linus Tech Tips YouTube hack is the latest in a series of crypto scam breaches
The popular YouTube channel Linus Tech Tips was hacked this morning, with the channel’s 15.3 million subscribers seeing crypto scam videos instead of tech hardware reviews. It is the latest breach in a series of high-profile YouTube accounts being hacked, with scammers regularly accessing prominent accounts to rename them and live-stream crypto scam videos.
The main Linus Tech Tips channel was hacked earlier this morning, with several live videos airing before the hacker began making old private videos public. The account was eventually suspended, presumably while YouTube staff work to restore it. Other Linus Media Group YouTube channels, including Techquickie and TechLinked, have also been hacked and given new names targeting Tesla.
It’s not immediately clear how the channels broke, but owner Linus Sebastian tweeted that he was aware of the situation. Then, in one statement posted on Floatplane (a streaming service that spun out of Linus Media Group), he said the company is working on it with Google and “getting to the bottom of the attack vector with the (hopeful) goal of strengthening their security around YouTube accounts and preventing this kind of things won’t happen to anyone in the future, he also promised to discuss additional details about the company’s podcast, though he cautioned that they might not come this week because it’s “still a developing situation.”
This is just the latest in a series of breaches that have taken place over the past year, generally designed to promote live streams that direct viewers to amateur-looking crypto sites via links or QR codes. The British Army’s YouTube channel was hacked last year to promote crypto scams, just months before tens of thousands of “viewers” watched a fake Apple crypto scam on YouTube. Popular Vevo channels on YouTube for artists like Lil Nas X, Drake, Taylor Swift and more were also hit last year with a breach where videos were uploaded from an “unauthorized source.”
We’ve reached out to Google to comment on this latest YouTube incident and provide details on exactly what the company is doing to protect creators here. While today’s breaches may be due to a combination of passwords and two-factor authentication, it feels like YouTube could be doing more to prevent the damaging effects of this.
This scam has been going on for months, and one YouTuber claims they work through fake sponsors who contact creators. The YouTubers are then convinced to download a file related to the sponsorship, which is simply malware designed to steal cookies, remote control PCs and ultimately hijack YouTube accounts.
I personally would like to see YouTube implement a lock down mode for high-profile accounts where if you log in from an unknown browser or location (based on IP and other factors) you won’t be able to change a channel name or access live streaming options or delete video for a certain period of time. Combined with alerts for when a new location has joined, this can help channel owners recover their YouTube accounts before any real damage is done.
YouTube could also implement a security system where you need a second approval from another account to rename a channel or remove videos or even additional two-factor channel action prompts. This can also help slow down the impact of a breach on a YouTuber’s own machine. Hopefully YouTube has even better ideas and can get this under control because I’m tired of waking up to a phone full of notifications about junk crypto videos from YouTube.
Update March 23, 10:05 AM ET: Article updated with more information on how the scam works.
Update March 23, 2:39 PM ET: Added an additional statement from Linus about the hack.