My bet is on one of those social media managers like Hootsuite/Social Blade/Buffer getting hacked.
Or maybe it was a multipronged attack that included social media management software and OAuth
but the hilarious most visible solution is that Twitter now disabled all verified accounts
and they should keep it that way