Blockchain investigator ZachXBT uncovered a coordinated network of accounts on X using exaggerated or fake war and geopolitical posts to lure users into cryptocurrency scams. The investigation identified over 10 linked accounts that used AI to impersonate influencers, posting sensational content to drive engagement before promoting fraudulent token schemes. According to ZachXBT, onchain evidence suggests the scheme profited over $100,000.
Blockchain investigator ZachXBT stated he uncovered a coordinated network of accounts on X using exaggerated or fake war and geopolitical posts to lure users into crypto scams. His investigation identified more than 10 linked X accounts that pushed sensational content and scam links.
The fake accounts used AI to impersonate prominent social media influencers such as Mario Nawfal. They flooded X with viral posts before promoting fake crypto giveaways and pump-and-dump token schemes. ZachXBT said “Onchain evidence suggests the scheme profited six figures,” and noted the group may be preparing another scam.
According to ZachXBT, the scheme started with accounts that had existing followers. These accounts repeatedly posted exaggerated war or political content, which quickly went viral and attracted millions of views.
Once attention peaked, the fake accounts pivoted to promote fraudulent token giveaways or scam tokens. One such promotion involved a pump-and-dump crypto scam referred to as Oramama on Feb. 22, ZachXBT noted.
The revelation comes as social media platforms like X have been trying to clamp down on bots and scam activity. Last month, X’s product chief Nikita Bier announced enhanced anti‑bot detection and removal measures, as part of broader efforts to curb automated spam and misinformation.
Still, the ZachXBT findings expose how quickly coordinated accounts can build engagement and mislead users. The investigator suggested that platform manipulation should lead to bans and legal consequences.
ZachXBT also shared a list of X users he believes to be involved in the scam in case they change usernames, detailed here.
