Special report · October 31, 2026 · 14:03
Spooky Shadows Special Report: The Tweet That Shook Wall Street
On April 23, 2013, a hacked news agency account posted a fake report of explosions at the White House. Within minutes, automated trading wiped $136 billion off the markets. This is the true story of Ahmad Umar Agha, the Syrian Electronic Army hacker sentenced this week to 42 months in federal prison, and the thirteen-year conspiracy behind the tweet. As of October 31, 2026.
Listen
Watch on YouTube · Listen on Spotify · Companion article by Felix McKenzie
CASE SUMMARY
At 1:07 p.m. Eastern Time on April 23, 2013, a message appeared on the official Twitter account of the Associated Press: two explosions at the White House, President Barack Obama injured. The report was false — the account had been compromised by the Syrian Electronic Army, and the tweet was posted by Ahmad Umar Agha, known online as Th3Pr0. Within three minutes, high-frequency trading algorithms reading the headline as genuine breaking news sold off; the Dow fell nearly 145 points and roughly $136.5 billion in S&P 500 market capitalisation was temporarily erased (a market-cap decline, not a realised cash loss). The AP recovered its account, deleted the message, and the White House confirmed the president was unhurt; the market recovered within minutes. In March 2016 the DOJ announced charges against three Syrian nationals; Agha was sentenced on October 29, 2026, to three years and six months in federal prison. The department's announcement describes the conspiracy as organised by members of the inner circle of Syria's former president Bashar al-Assad, and attributes roughly 47 intrusions to Agha personally. Co-defendant Firas Dardar remains a fugitive, and everything about his role stays alleged.
PERSONS OF INTEREST
Ahmad Umar Agha (Th3Pr0) — CONVICTED; sentenced October 29, 2026, to 42 months in federal prison for the hacking conspiracy; per the DOJ's sentencing announcement he later described the market decline as an intended outcome of the operation. Firas Dardar (The Shadow) — indicted May 2018 alongside Agha; REMAINS A FUGITIVE; everything about his alleged role stays alleged until a court says otherwise. The Syrian Electronic Army — hacking crew claiming to be patriotic volunteers; the Justice Department describes it as a state intelligence operation serving the former Assad government, used for information warfare, intimidation, spying, and intelligence collection. President Barack Obama — unharmed; the White House corrected the false claim within minutes. Assistant Attorney General for National Security John Eisenberg — at sentencing described the attacks as an assault on the free press and on American national and economic security.
CHRONOLOGY
August 2011 — the conspiracy begins, per the DOJ indictment. April 23, 2013, 1:07 p.m. ET — the fake AP tweet; the Dow falls nearly 145 points within minutes, then recovers. September 2013 — the crew compromises the company hosting the US Marine Corps recruiting website and redirects visitors to a political message. June 2014 — the DOJ files a sealed criminal complaint against Agha (a 2014 FBI affidavit ties the hijacked account's password-reset email to him). March 2016 — the complaint is unsealed; the DOJ announces charges against three Syrian nationals; Agha and Dardar are placed on the FBI's Cyber Most Wanted list. September 2016 — Peter Romar pleads guilty in a related extortion conspiracy. May 2018 — a federal grand jury indicts Agha and Dardar. December 2024 — the Assad government falls; Bashar al-Assad flees. October 29, 2026 — Agha is sentenced to 42 months in federal prison; Dardar remains a fugitive.
DISPOSITION
Sentenced: Ahmad Umar Agha, 42 months in federal prison. At large: Firas Dardar, alleged co-conspirator, fugitive. The April 2013 market disruption lasted minutes; the correction mechanisms worked — but they worked after the initial disruption. A follow-up piece will cover the case when it moves — the capture of Dardar, or any development in the wider proceedings.