Disclaimer. This is just my personal speculation about the current Twitter situation.

Since this attack was preceded by the hacking of Jack Dorsey's account through a mobile provider vulnerability, my suspicion falls on a large Trump-friendly country, known for their state-sponsored hackers. The motive would be to punish Jack for his anti-Trump stance.

When they gained access to Jack's account these hackers might've found access credentials, like a root password, and decided to quickly capitalize on their find with a simple bitcoin scam, aswell as just generally messing about with the platform.