The attack began with a tweet from Dean Norris's official account announcing the fake token and the associated contract address.