This si so embarassing and it pointed out that we don't actually need a password. Not your key, not your access should be implemented.
This is no ordinary hack, it's too hard to hack Twitter, and I believe they have enough security to keep people safe. I think someone inside the company did this