Old Bitly Links Are Being Hijacked

Update, 15 November, 22:30 UTC: Bitly has confirmed the problem. In a article on X at 19:13 UTC it stated it had identified an matter that “allowed bad actors to repurpose certain old, idle links” and dispatch group to unrelated content. Bitly stated it has suspended the accounts engaged and is disabling the affected links.

Update, 15 November, 19:30 UTC: The Burger King and McDonald’s links no longer redirect. Both were motionless operating at 15:05 UTC and returned Bitly’s “Link Deactivated” leaf by 19:22 UTC. The identical has happened to the two additional Trump links we verified and to six of the seven links in our example that pointed location new. The seventh now shows a Bitly alert that the document that created it has been suspended. The 49 re-created links that appearance akin the originals motionless work.

Burger King’s X document was not hacked. A Bitly abbreviated nexus in a tweet the sequence posted on 24 July 2011 was registered again by person alternatively on 15 November 2026 and pointed at Wikipedia’s catalog of Nazi concentration camps. The tweet was promotion a eatery locator. A article quoting it passed 2 myriad views inside hours, and Burger King’s first has since rotate into unavailable.

It was not the lone one. Eighteen minutes before a Bitly nexus in a McDonald’s tweet from 7 June 2011 was registered the identical way and pointed at Wikipedia’s part on the September 11 attacks. Ransomnews additionally checked 97 Bitly links in Donald Trump’s tweets from 2009 to 2013, taken from a community archive. Bitly’s own nexus pages display that 56 were created following the tweets they sit in, and a 57th is blocked by Bitly as malicious or spam. Four were registered on 15 November. Two more, created in January 2024 and January 2025, item at domains that copy the names of crypto services.

In brief

• Burger King posted the tweet on 24 July 2011 alongside the abbreviated nexus bit[.]ly/19BFiM. Bitly’s data leaf for that nexus gives a innovation period of 05:32 UTC on 15 November 2026 and a destination on Wikipedia.
• A nexus in a McDonald’s tweet from 7 June 2011, bit[.]ly/mLWJO0, was created again at 05:14 UTC the identical morning, 18 minutes before Burger King’s. It opens Wikipedia’s part on the September 11 attacks. Both tweets have since rotate into unavailable.
• Nobody posted from either company’s account. The links changed hands on Bitly’s side, so the old tweets dispatch readers anywhere the new owners choose.
• Of 97 Bitly links in Donald Trump’s tweets from 2009 to 2013, 40 are motionless the original. Another 49 were created again afterward but guide anywhere the tweets suggest, 48 of them in a 17-minute run on 26 May 2023. Seven guide location alternatively and one is blocked by Bitly.
• Four of those seven were registered on 15 November 2026 between 07:49 and 09:57 UTC. They open a Roblox profile, a YouTube video (twice) and a Wikipedia part concerning Trump and Jeffrey Epstein.
• One Trump tweet from April 2011 carries three links to videos of his children. All three have been replaced.
• Bitly’s assistance pages say the ending of a bit.ly nexus cannot be reused, equal following the document rearward it is deleted. In February 2025 it was reported to have fixed a bug that allowed this.
• We established no community declaration from Bitly, Burger King or McDonald’s by 14:30 UTC on 15 November.
• By 19:22 UTC the two links returned Bitly’s “Link Deactivated” page. None of the seven Trump links that pointed location new redirects any more.
• Bitly confirmed the matter on X at 19:13 UTC. It stated it has suspended the accounts engaged and is disabling the affected links.

Was Burger King hacked?

No. Nothing was posted from Burger King’s document and nothing suggests anyone got into it. The tweet is 15 years old and says as it continually did, pointing followers to “our helpful eatery locator” through a Bitly link. What changed is anywhere that nexus goes. As alongside the Microsoft 365 outage three days earlier, the archetypal inquiry group asked was whether it was an assault on the company, and the answer is the same.

Bitly keeps a community data leaf for all abbreviated link. Add a affirmative sign to the end of the location and it shows anywhere the nexus points and whenever it was created. For bit[.]ly/19BFiM that leaf gives the destination as Wikipedia’s “List of Nazi concentration camps” and the innovation period as 15 November 2026, 05:32 UTC. A nexus printed in a tweet from 2011 can lone transport a 2026 innovation date if the identical ending was issued a second time.

We tested the method on links nobody disputes. A nexus whose creator says he made it in 2009 shows a 2009 innovation date. A tradition nexus tweeted by a YouTube conduit on 21 June 2017 shows 20 June 2017. Among the Trump links that are motionless original, 32 of 40 were created on the day of the tweet or the day before.

The article that dispersed it came from an X person at 06:51 UTC, 79 minutes following the nexus was created, and had 2.2 myriad views by first afternoon.

By 13:45 UTC the Burger King article inner it was showing as unavailable. We do not cognize whether Burger King removed it or X did. The abbreviated nexus was motionless redirecting to Wikipedia at 13:47 UTC.

Was McDonald’s hacked?

No. Its nexus was changed 18 minutes before Burger King’s. On 7 June 2011 McDonald’s tweeted a Bitly nexus to item its squad in Sweden had done. Bitly’s data leaf for bit[.]ly/mLWJO0 shows the nexus was created at 05:14 UTC on 15 November 2026, and it redirects to Wikipedia’s part on the September 11 attacks. The tweet was returning a not-found error whenever we checked at 14:20 UTC.

The two changes are near in period and alike in style. The X person Alex Greenland, who spotted the two timestamps, thinks one individual or collection is likely rearward them. Nothing we have seen proves that.

How does an old Bitly nexus get hijacked?

Someone registers its ending again. The part of a Bitly nexus following the slash is called the back-half. Bitly generates one at random, or the person types a tradition one. If an old nexus stops existing and its back-half can be claimed, whoever claims it decides anywhere all tweet, email, PDF and printed QR code carrying that nexus now leads. No password is taken and no document is touched, so the brand that posted the nexus sees nothing wrong.

Bitly says this cannot happen. Its help leaf on deleted accounts states that bit.ly links keep operating and that their back-halves “cannot be re-used”, whether they were generated or custom. A distinct page says Bitly deletes accounts that have been idle for three years. The innovation dates we collected do not fit the archetypal statement. Back-halves that appear in tweets from 2009 to 2012 pertain to links created between 2023 and today.

It has happened before. In February 2025 Disruptionist reported that memecoin promoters had taken complete Bitly links in 2013 posts by Donald Trump and Melania Trump and pointed them at token listings. According to that report, a bug let group assertion a back-half formerly the first nexus or its document had been deleted or deactivated, and Bitly fixed it and switched off the hijacked links. Links created on 15 November 2026 display the identical item is imaginable now.

The X person Damin Toell identified it as nexus hijacking at 07:25 UTC and noted that old Trump posts were affected too.

At 09:18 UTC another person described the method in a article that has been viewed additional than 46,000 times. Three additional Trump links were registered in the 40 minutes that followed.

How many old links have been replaced?

More than fractional of the ones we tested. We took all tweet Donald Trump’s document posted from 2009 to 2016 from the Trump Twitter Archive data set on GitHub, remaining out retweets and extracted the bit.ly links. That gave 97 distinct links, archetypal used between 2009 and 2013, alongside 61 of them from 2011. We chose this document since its old posts were named in the reports of 15 November and in the 2025 case, and since a complete community archive exists. For all nexus we recorded anywhere it redirects and the innovation date on Bitly’s data page, at concerning 13:45 UTC on 15 November 2026.

Forty links are untouched. Forty-nine were created again afterward and guide to addresses that fit the tweets: mostly videos on Trump’s YouTube channel, affirmative pages at CNBC, CNN and the Wall Street Journal. Forty-eight of those were created between 14:55 and 15:12 UTC on 26 May 2023, approximately one all 20 seconds. We do not cognize who did that. It looks akin a repair job by person who knew anywhere all nexus used to go, and it method those back-halves were liberated to assertion by May 2023.

That leaves eight links that now guide location their tweets never pointed.

One tweet, three replaced links

On 25 April 2011 the document posted three Bitly links to “The Next Generation” videos of Donald Trump Jr., Ivanka Trump and Eric Trump. The archetypal now leads to worldlibertyfinancial-ai[.]com, a domain that borrows the name of World Liberty Financial, the Trump family’s crypto venture. The third leads to dappradars[.]website, one letter distant from the crypto analytics location DappRadar, at a way named “eligibility/check”. Bitly blocks the second alongside a notice that it was “flagged as redirecting to malicious or spam content”.

WHOIS records from WhoisXML API display the two domains were registered afresh following the links were created. The current registration of dappradars[.]website began at 02:56 UTC on 15 November 2026, through Hostinger, although the Bitly nexus that points there was created in January 2024. The domain now forwards to a YouTube video. The current registration of worldlibertyfinancial-ai[.]com dates from 11 April 2026, through Namecheap, nearly 15 months following the nexus was created, and its HTTPS certificate unsuccessful verification whenever we checked. We have not seen what either domain served whenever the links were archetypal made.

A replaced nexus can be replaced again. When the domain rearward it lapses, the next buyer inherits any traffic the old tweet motionless sends.

More Trump links exterior our 97

X users established replaced Bitly links in Trump tweets from 2012 and 2013 that the archive stores lone as t.co addresses. We checked two. The nexus in a tweet of 10 January 2013 was created at 23:52 UTC on 14 November 2026 and opens a leaf on Steam. The nexus in a tweet of 10 September 2012 was created at 01:04 UTC on 15 November and opens a YouTube video. Late on 14 November is the earliest alter in this motion that we have seen.

How we counted

We used the archive’s condensed annual records for 2009 to 2016 and established bit.ly links lone in tweets up to 2013. From delayed 2011 Twitter wrapped links in its own t.co shortener, and the archive stores most afterward links in that form (1,218 of them in 2012), so Bitly links rearward those are not among our 97. A nexus counts as created again whenever Bitly’s data leaf shows a innovation date additional than 30 days following the archetypal tweet that used it. In custom the gap was at smallest 11 years in all case. Destinations were peruse from the redirect header without beginning the pages. The figure covers one document and one nexus shortener. It shows that these links were claimed. How many of Bitly’s older links can be claimed is item lone Bitly can answer. Domain registration data is from WhoisXML API.

What happened on 15 November 2026?

The archetypal alter we established came delayed on 14 November. The McDonald’s and Burger King links followed at 05:14 and 05:32 UTC the next morning. All times below are UTC and on 15 November unless stated.

• 23:52 on 14 November. A nexus in a 2013 Trump tweet is registered and pointed at a leaf on Steam, the earliest alter we found.
• 01:04. A nexus in a 2012 Trump tweet is registered and pointed at a YouTube video.
• 02:56. dappradars[.]website, the mark of a Trump nexus replaced in 2024, is registered afresh.
• 05:14. The back-half in McDonald’s 2011 tweet is registered and pointed at Wikipedia.
• 05:32. The back-half in Burger King’s 2011 tweet is registered and pointed at Wikipedia.
• 06:51. An X person quotes the Burger King tweet. The article goes on to continue 2 myriad views.
• 07:25. Another person identifies it as nexus hijacking and says old Trump posts are affected.
• 07:49. A nexus in a 2009 Trump tweet is registered and pointed at a Roblox profile.
• 09:18. A person describes the method in public.
• 09:36 to 09:57. Three links in 2010 Trump tweets are registered.
• 13:45. Burger King’s article shows as unavailable. Its nexus motionless redirects to Wikipedia.
• 14:20. McDonald’s article returns a not-found error. Its nexus motionless redirects to Wikipedia too.
• 15:05. Both links motionless redirect to Wikipedia.
• 19:13. Bitly says on X that an matter let old, idle links be repurposed, that it has suspended the accounts engaged and that it is disabling the affected links.
• 19:22. Both links come back Bitly’s “Link Deactivated” page. So do six of the seven Trump links in our example that pointed location new and the two we verified exterior it. The seventh shows a alert that the document that created it has been suspended.

Why does a gag nexus matter?

Because the identical move plant for fraud. The examples from 15 November are pranks: a Wikipedia page, a equivalent profile, a video. The 2025 motion pushed memecoins, and two of the Trump links in our array guide to domains named following crypto services. A nexus inner an old article from a verified brand, a bank, a ministry or a news outlet carries that account’s credibility, and X shows the article exactly as it was written. Readers have no logic to doubt it.

The visibility is wider than X. The identical abbreviated links sit in old emails, PDFs, glide decks, printed QR codes and assistance pages. Security researchers document this under broken nexus hijacking: a nexus outlives the item it pointed to, and person alternatively moves in.

What should brands and readers do?

Any institution that posted abbreviated links years ago should assume several of them are no longer its own.

• List the abbreviated links in your old posts. Export your article archive from all phase and drag out all bit.ly address.
• Check all one. Add a affirmative sign to the nexus and difference Bitly’s innovation date alongside the date of your post. A afterward date method the nexus is no longer yours.
• Remove what you cannot fix. Delete posts whose links were replaced or no longer resolve, and study replaced links to Bitly.
• Use a abbreviated domain you own for new links, so nobody alternatively can matter the identical address.

For everyone else, the checks obtain a few seconds.

• Do not rely a nexus since the article is old or the document is verified. The document owner may have no authority complete anywhere it goes.
• Preview before you click. Adding a affirmative sign to a bit.ly nexus shows the destination without visiting it.
• Be most careful alongside pages that ask you to sign in or nexus a crypto wallet.

What happens next?

Bitly has to say whether old back-halves can motionless be claimed and what it volition do concerning the ones already taken. We established no community declaration from Bitly, Burger King or McDonald’s by 14:30 UTC on 15 November. Later that day the links that pointed location new were deactivated, and 49 others created years following their tweets were remaining working. Bitly confirmed the matter on X at 19:13 UTC and stated it was motionless disabling affected links. Checks akin this one are what our breach verification desk is for, and we volition update this part whenever either business responds or the numbers move.

Frequently asked questions

Sources and additional reading

• Bitly Help Center: what happens to links following an document is deleted
• Bitly Help Center: why an document would be deleted
• Disruptionist: Crypto scammers hacked Trump’s tweets via a bug (3 February 2025)
• Trump Twitter Archive data set on GitHub
• X article quoting the Burger King tweet (15 November 2026)
• X article by Damin Toell on the hijacked links (15 November 2026)
• X article by Alex Greenland on the McDonald’s and Burger King timestamps (15 November 2026)
• Acunetix: What is damaged nexus hijacking
• Domain registration records: WhoisXML API.
• Related study on Ransomnews: Microsoft 365 outage: was it a cyberattack?