The fact so many big accounts got hacked just means they got into the Twitter Database and were able to figure out their hash algorithm and can now easily unlock their passwords.
Shame on Twitter. They should have made it far harder for this to happen for a company this large.
It's not just passwords as many of the accounts had 2FA, could have been carried out from the inside or have been a hack of the user account control panel though. Other floated theories include an API vulnerability or a vulnerability with third party account management software that has been granted post access but that seems less likely with this scope.
We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools
Explains the crude nature of the attack, both in how slow it was (One message every few mins over the course of several hours, doesn't imply much manpower), and the nature of the scam itself(Stealing a small amount of BTC, or possibly earning a small amount more from having shorted BTC beforehand, is ridiculously crude given the power briefly attained here). Some people theorising it's all a cover up for something more sinister, but of course nothing backs that up yet.