Twitter said it was not yet certain what the hackers may have done beyond sending the bitcoin messages.
"We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it," the company said.
Mass compromises of Twitter accounts via theft of employee credentials or problems with third-party applications that many users employ have occurred before.
Wednesday's Twitter hacking incident was the worst to date.
Several users with two-factor authentication — a security procedure that helps prevent break-in attempts — said they were powerless to stop it.
"If the hackers do have access to the backend of Twitter, or direct database access, there is nothing potentially stopping them from pilfering data in addition to using this tweet-scam as a distraction," said Michael Borohovski, director of software engineering at security company Synopsys.
(Writer: Joseph Menn, Raphael Satter)
Dapatkan update berita pilihan dan breaking news setiap hari dari Kompas.com. Mari bergabung di Grup Telegram "Kompas.com News Update", caranya klik link https://t.me/kompascomupdate, kemudian join. Anda harus install aplikasi Telegram terlebih dulu di ponsel.