Twitter has confirmed that a massive scam involving the breach of some of the platform's most-followed accounts was accomplished using its own internal systems and tools.

Early on Thursday morning accounts including those belonging to Bill Gates, Elon Musk, Joe Biden and Apple were among many that tweeted out an address to a Bitcoin wallet, promising that followers who paid money into it would get double that amount back. This followed the breach of Twitter accounts belonging to many popular cryptocurrency services, which made similar claims.

The sheer number of prominent accounts involved, and the fact that Twitter appeared unable to contain the scam tweets for more than an hour, led some experts to assume the breach had happened at the company itself, which Twitter has now confirmed.

In a series of tweets, the company said some of its employees were coerced into giving away access to a critical internal tool that gave attackers control over the accounts.

"We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools," the company said. Social engineering refers to manipulation such as faked emails and websites that can trick a person into divulging sensitive information.

"We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf. We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it."

Shortly after Twitter became aware of the attack they locked all verified accounts, preventing them from sending tweets. Functionality has since been restored to most accounts, but those that had tweeted the Bitcoin links remain locked while the investigation continues.

The scammers appeared to use multiple Bitcoin wallets, but the one listed in many tweets appears to have received almost 13 Bitcoin, or around $171,000.

Paul Ducklin, principal research scientist at British cyber security company Sophos, said the presence of cryptocurrency should always tip users off to a scam.

"Cryptocurrency transactions don’t have the legal protections that you get with banks or payment card companies," he said.

"There is no fraud reporting service or transaction cancellation in the world of cryptocurrency. Sending someone crypto coins is like handing over banknotes in an envelope; if they go to a crook, you will never see them again."