Old Bitly links hijacked in Burger King, McDonald’s and Trump tweets
Update, 15 November, 22:30 UTC: Bitly has confirmed the problem. In a post on X at 19:13 UTC it said it had identified an issue that “allowed bad actors to repurpose certain old, inactive links” and send people to unrelated content. Bitly said it has suspended the accounts involved and is disabling the affected links.
Update, 15 November, 19:30 UTC: The Burger King and McDonald’s links no longer redirect. Both were still working at 15:05 UTC and returned Bitly’s “Link Deactivated” page by 19:22 UTC. The same has happened to the two extra Trump links we verified and to six of the seven links in our sample that pointed somewhere new. The seventh now shows a Bitly warning that the account that created it has been suspended. The 49 re-created links that look like the originals still work.
Burger King’s X account was not hacked. A Bitly short link in a tweet the chain posted on 24 July 2011 was registered again by someone else on 15 November 2026 and pointed at Wikipedia’s list of Nazi concentration camps. The tweet was advertising a restaurant locator. A post quoting it passed 2 million views within hours, and Burger King’s original has since become unavailable.
It was not the only one. Eighteen minutes earlier a Bitly link in a McDonald’s tweet from 7 June 2011 was registered the same way and pointed at Wikipedia’s article on the September 11 attacks. Ransomnews also checked 97 Bitly links in Donald Trump’s tweets from 2009 to 2013, taken from a public archive. Bitly’s own link pages show that 56 were created after the tweets they sit in, and a 57th is blocked by Bitly as malicious or spam. Four were registered on 15 November. Two more, created in January 2024 and January 2025, point at domains that copy the names of crypto services.
In brief
- Burger King posted the tweet on 24 July 2011 with the short link bit[.]ly/19BFiM. Bitly’s information page for that link gives a creation time of 05:32 UTC on 15 November 2026 and a destination on Wikipedia.
- A link in a McDonald’s tweet from 7 June 2011, bit[.]ly/mLWJO0, was created again at 05:14 UTC the same morning, 18 minutes before Burger King’s. It opens Wikipedia’s article on the September 11 attacks. Both tweets have since become unavailable.
- Nobody posted from either company’s account. The links changed hands on Bitly’s side, so the old tweets send readers wherever the new owners choose.
- Of 97 Bitly links in Donald Trump’s tweets from 2009 to 2013, 40 are still the original. Another 49 were created again later but lead where the tweets suggest, 48 of them in a 17-minute run on 26 May 2023. Seven lead somewhere else and one is blocked by Bitly.
- Four of those seven were registered on 15 November 2026 between 07:49 and 09:57 UTC. They open a Roblox profile, a YouTube video (twice) and a Wikipedia article about Trump and Jeffrey Epstein.
- One Trump tweet from April 2011 carries three links to videos of his children. All three have been replaced.
- Bitly’s help pages say the ending of a bit.ly link cannot be reused, even after the account behind it is deleted. In February 2025 it was reported to have fixed a bug that allowed this.
- We found no public statement from Bitly, Burger King or McDonald’s by 14:30 UTC on 15 November.
- By 19:22 UTC both links returned Bitly’s “Link Deactivated” page. None of the seven Trump links that pointed somewhere new redirects any more.
- Bitly confirmed the issue on X at 19:13 UTC. It said it has suspended the accounts involved and is disabling the affected links.
Was Burger King hacked?
No. Nothing was posted from Burger King’s account and nothing suggests anyone got into it. The tweet is 15 years old and reads as it always did, pointing followers to “our handy restaurant locator” through a Bitly link. What changed is where that link goes. As with the Microsoft 365 outage three days earlier, the first question people asked was whether it was an attack on the company, and the answer is the same.
Bitly keeps a public information page for every short link. Add a plus sign to the end of the address and it shows where the link points and when it was created. For bit[.]ly/19BFiM that page gives the destination as Wikipedia’s “List of Nazi concentration camps” and the creation time as 15 November 2026, 05:32 UTC. A link printed in a tweet from 2011 can only carry a 2026 creation date if the same ending was issued a second time.
We tested the method on links nobody disputes. A link whose creator says he made it in 2009 shows a 2009 creation date. A custom link tweeted by a YouTube channel on 21 June 2017 shows 20 June 2017. Among the Trump links that are still original, 32 of 40 were created on the day of the tweet or the day before.
The post that spread it came from an X user at 06:51 UTC, 79 minutes after the link was created, and had 2.2 million views by early afternoon.
By 13:45 UTC the Burger King post inside it was showing as unavailable. We do not know whether Burger King removed it or X did. The short link was still redirecting to Wikipedia at 13:47 UTC.
Was McDonald’s hacked?
No. Its link was changed 18 minutes before Burger King’s. On 7 June 2011 McDonald’s tweeted a Bitly link to something its team in Sweden had done. Bitly’s information page for bit[.]ly/mLWJO0 shows the link was created at 05:14 UTC on 15 November 2026, and it redirects to Wikipedia’s article on the September 11 attacks. The tweet was returning a not-found error when we checked at 14:20 UTC.
The two changes are close in time and alike in style. The X user Alex Greenland, who spotted both timestamps, thinks one person or group is probably behind them. Nothing we have seen proves that.
How does an old Bitly link get hijacked?
Someone registers its ending again. The part of a Bitly link after the slash is called the back-half. Bitly generates one at random, or the user types a custom one. If an old link stops existing and its back-half can be claimed, whoever claims it decides where every tweet, email, PDF and printed QR code carrying that link now leads. No password is stolen and no account is touched, so the brand that posted the link sees nothing wrong.
Bitly says this cannot happen. Its help page on deleted accounts states that bit.ly links keep working and that their back-halves “cannot be re-used”, whether they were generated or custom. A separate page says Bitly deletes accounts that have been inactive for three years. The creation dates we collected do not fit the first statement. Back-halves that appear in tweets from 2009 to 2012 belong to links created between 2023 and today.
It has happened before. In February 2025 Disruptionist reported that memecoin promoters had taken over Bitly links in 2013 posts by Donald Trump and Melania Trump and pointed them at token listings. According to that report, a bug let people claim a back-half once the original link or its account had been deleted or deactivated, and Bitly fixed it and switched off the hijacked links. Links created on 15 November 2026 show the same thing is possible now.
The X user Damin Toell identified it as link hijacking at 07:25 UTC and noted that old Trump posts were affected too.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
At 09:18 UTC another user described the method in a post that has been viewed more than 46,000 times. Three more Trump links were registered in the 40 minutes that followed.
How many old links have been replaced?
More than half of the ones we tested. We took every tweet Donald Trump’s account posted from 2009 to 2016 from the Trump Twitter Archive data set on GitHub, left out retweets and extracted the bit.ly links. That gave 97 different links, first used between 2009 and 2013, with 61 of them from 2011. We chose this account because its old posts were named in the reports of 15 November and in the 2025 case, and because a full public archive exists. For each link we recorded where it redirects and the creation date on Bitly’s information page, at about 13:45 UTC on 15 November 2026.
57 of 97 Bitly links in old Trump tweets are no longer the original
Bitly links in @realDonaldTrump tweets from 2009 to 2013, by what the link is today. Checked on 15 November 2026.
Created again, leads where the tweet suggests49
Still the original link40
Created again, leads somewhere else7
Blocked by Bitly1
Source: Ransomnews check of Bitly link information pages. Tweets from the Trump Twitter Archive data set.
Forty links are untouched. Forty-nine were created again later and lead to addresses that fit the tweets: mostly videos on Trump’s YouTube channel, plus pages at CNBC, CNN and the Wall Street Journal. Forty-eight of those were created between 14:55 and 15:12 UTC on 26 May 2023, roughly one every 20 seconds. We do not know who did that. It looks like a repair job by someone who knew where each link used to go, and it means those back-halves were free to claim by May 2023.
That leaves eight links that now lead somewhere their tweets never pointed.
| Tweet date | What the tweet promoted | Link created again | Where it goes now |
|---|---|---|---|
| 3 Jun 2009 | An iGoogle page | 15 Nov 2026, 07:49 UTC | A Roblox user profile |
| 1 Jul 2010 | A golf course in Scotland | 15 Nov 2026, 09:36 UTC | A YouTube video |
| 17 Sep 2010 | A QVC jewellery show | 15 Nov 2026, 09:47 UTC | The same YouTube video |
| 7 Oct 2010 | A golf course in Scotland | 15 Nov 2026, 09:57 UTC | Wikipedia’s article on Trump and Jeffrey Epstein |
| 14 Mar 2011 | A video blog | 29 Jan 2025, 21:09 UTC | test[.]com |
| 25 Apr 2011 | A video of Donald Trump Jr. | 18 Jan 2025, 21:43 UTC | worldlibertyfinancial-ai[.]com |
| 25 Apr 2011 | A video of Eric Trump | 17 Jan 2024, 11:08 UTC | dappradars[.]website |
| 25 Apr 2011 | A video of Ivanka Trump | Not shown | Blocked by Bitly as malicious or spam |
One tweet, three replaced links
On 25 April 2011 the account posted three Bitly links to “The Next Generation” videos of Donald Trump Jr., Ivanka Trump and Eric Trump. The first now leads to worldlibertyfinancial-ai[.]com, a domain that borrows the name of World Liberty Financial, the Trump family’s crypto venture. The third leads to dappradars[.]website, one letter away from the crypto analytics site DappRadar, at a path named “eligibility/check”. Bitly blocks the second with a notice that it was “flagged as redirecting to malicious or spam content”.
WHOIS records from WhoisXML API show both domains were registered afresh after the links were created. The current registration of dappradars[.]website began at 02:56 UTC on 15 November 2026, through Hostinger, although the Bitly link that points there was created in January 2024. The domain now forwards to a YouTube video. The current registration of worldlibertyfinancial-ai[.]com dates from 11 April 2026, through Namecheap, almost 15 months after the link was created, and its HTTPS certificate failed verification when we checked. We have not seen what either domain served when the links were first made.
A replaced link can be replaced again. When the domain behind it lapses, the next buyer inherits whatever traffic the old tweet still sends.
More Trump links outside our 97
X users found replaced Bitly links in Trump tweets from 2012 and 2013 that the archive stores only as t.co addresses. We checked two. The link in a tweet of 10 January 2013 was created at 23:52 UTC on 14 November 2026 and opens a page on Steam. The link in a tweet of 10 September 2012 was created at 01:04 UTC on 15 November and opens a YouTube video. Late on 14 November is the earliest change in this wave that we have seen.
How we counted
We used the archive’s condensed yearly files for 2009 to 2016 and found bit.ly links only in tweets up to 2013. From late 2011 Twitter wrapped links in its own t.co shortener, and the archive stores most later links in that form (1,218 of them in 2012), so Bitly links behind those are not among our 97. A link counts as created again when Bitly’s information page shows a creation date more than 30 days after the first tweet that used it. In practice the gap was at least 11 years in every case. Destinations were read from the redirect header without opening the pages. The count covers one account and one link shortener. It shows that these links were claimed. How many of Bitly’s older links can be claimed is something only Bitly can answer. Domain registration data is from WhoisXML API.
What happened on 15 November 2026?
The first change we found came late on 14 November. The McDonald’s and Burger King links followed at 05:14 and 05:32 UTC the next morning. All times below are UTC and on 15 November unless stated.
- 23:52 on 14 November. A link in a 2013 Trump tweet is registered and pointed at a page on Steam, the earliest change we found.
- 01:04. A link in a 2012 Trump tweet is registered and pointed at a YouTube video.
- 02:56. dappradars[.]website, the target of a Trump link replaced in 2024, is registered afresh.
- 05:14. The back-half in McDonald’s 2011 tweet is registered and pointed at Wikipedia.
- 05:32. The back-half in Burger King’s 2011 tweet is registered and pointed at Wikipedia.
- 06:51. An X user quotes the Burger King tweet. The post goes on to pass 2 million views.
- 07:25. Another user identifies it as link hijacking and says old Trump posts are affected.
- 07:49. A link in a 2009 Trump tweet is registered and pointed at a Roblox profile.
- 09:18. A user describes the method in public.
- 09:36 to 09:57. Three links in 2010 Trump tweets are registered.
- 13:45. Burger King’s post shows as unavailable. Its link still redirects to Wikipedia.
- 14:20. McDonald’s post returns a not-found error. Its link still redirects to Wikipedia too.
- 15:05. Both links still redirect to Wikipedia.
- 19:13. Bitly says on X that an issue let old, inactive links be repurposed, that it has suspended the accounts involved and that it is disabling the affected links.
- 19:22. Both links return Bitly’s “Link Deactivated” page. So do six of the seven Trump links in our sample that pointed somewhere new and the two we verified outside it. The seventh shows a warning that the account that created it has been suspended.
Why does a joke link matter?
Because the same move works for fraud. The examples from 15 November are pranks: a Wikipedia page, a game profile, a video. The 2025 wave pushed memecoins, and two of the Trump links in our table lead to domains named after crypto services. A link inside an old post from a verified brand, a bank, a ministry or a news outlet carries that account’s credibility, and X shows the post exactly as it was written. Readers have no reason to doubt it.
The exposure is wider than X. The same short links sit in old emails, PDFs, slide decks, printed QR codes and help pages. Security researchers file this under broken link hijacking: a link outlives the thing it pointed to, and someone else moves in.
What should brands and readers do?
Any organisation that posted short links years ago should assume some of them are no longer its own.
- List the short links in your old posts. Export your post archive from each platform and pull out every bit.ly address.
- Check each one. Add a plus sign to the link and compare Bitly’s creation date with the date of your post. A later date means the link is no longer yours.
- Remove what you cannot fix. Delete posts whose links were replaced or no longer resolve, and report replaced links to Bitly.
- Use a short domain you own for new links, so nobody else can issue the same address.
For everyone else, the checks take a few seconds.
- Do not trust a link because the post is old or the account is verified. The account owner may have no control over where it goes.
- Preview before you click. Adding a plus sign to a bit.ly link shows the destination without visiting it.
- Be most careful with pages that ask you to sign in or connect a crypto wallet.
What happens next?
Bitly has to say whether old back-halves can still be claimed and what it will do about the ones already taken. We found no public statement from Bitly, Burger King or McDonald’s by 14:30 UTC on 15 November. Later that day the links that pointed somewhere new were deactivated, and 49 others created years after their tweets were left working. Bitly confirmed the issue on X at 19:13 UTC and said it was still disabling affected links. Checks like this one are what our breach verification desk is for, and we will update this article when either company responds or the numbers move.
Frequently asked questions
Was Burger King hacked in November 2026?
No. Nothing was posted from Burger King’s X account. A Bitly short link in a tweet from 24 July 2011 was registered again by someone else on 15 November 2026, so the old tweet began sending readers to a different page.
Was McDonald’s hacked?
No. A Bitly link in a McDonald’s tweet from 7 June 2011 was registered again at 05:14 UTC on 15 November 2026 and pointed at Wikipedia’s article on the September 11 attacks. Nothing was posted from the McDonald’s account.
Why did a Burger King tweet link to a list of Nazi concentration camps?
The tweet’s Bitly link, bit[.]ly/19BFiM, originally advertised a restaurant locator. Bitly’s information page shows the link was created again at 05:32 UTC on 15 November 2026 with a Wikipedia article as its destination. Burger King did not choose that destination.
What is Bitly link hijacking?
It is when someone registers the ending of an old Bitly link that no longer exists and points it at a page of their choice. Every old post, email or document that carries the link then leads to the new destination. No account is broken into.
How can I tell whether a Bitly link has been replaced?
Add a plus sign to the end of the link. Bitly shows the destination and the date the link was created. If the creation date is later than the post or document the link appears in, the link is not the original.
Were Donald Trump’s old tweets hacked?
No. Ransomnews checked 97 Bitly links in tweets from 2009 to 2013. Fifty-six were created again after the tweets were posted and one is blocked by Bitly. Seven of them lead to destinations unrelated to the tweets, including two domains that copy the names of crypto services.
Has Bitly fixed the problem?
A fix was reported in February 2025 after links in Trump posts were pointed at memecoin pages. Links created on 15 November 2026 show that old endings can be claimed now. Bitly had made no public statement that we could find by 14:30 UTC that day. It confirmed the issue on X at 19:13 UTC and said it was disabling the affected links.
Sources and further reading
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.
