Key Insights:
- Crypto scam network used war panic posts to promote pump-and-dump tokens and generated six-figure profits, according to on-chain investigator ZachXBT.
- Fraudsters bought old social media accounts and reused them to spread political fear content before posting fake giveaways.
- On-chain data linked at least ten accounts to coordinated token scams and engagement-farming campaigns.
Crypto scam activity has been linked to a coordinated group of social media accounts that used war-related posts to direct users toward fraudulent crypto promotions. On-chain investigator ZachXBT said the network relied on emotionally charged updates about the Middle East conflict to gain visibility on X before posting scam content.
He explained that the operators focused on highly negative political and military news because such posts usually attract fast reactions and repeated sharing from users. According to his investigation, the accounts posted alarming updates several times daily, building engagement before shifting attention toward links connected to a crypto scam campaign.
The researcher noted that the tactic worked because users already following global conflict updates were more likely to interact with urgent or frightening headlines. That interaction pushed the posts higher in feeds, allowing the same accounts to later introduce fraudulent giveaways and token promotions to a much larger audience.
Investigators reveal strategy behind viral panic posts
ZachXBT said the network followed a repeated structure designed to turn social media engagement into profit through carefully timed scam promotions. First, the operators purchased older accounts that already had followers, then began posting constant political warnings and war updates to rebuild activity levels.
After engagement increased, linked accounts reposted the same content to boost visibility and make the discussion appear organic to outside readers. As the posts had gained sufficient exposure, then the accounts began posting fake giveaways or suspicious tokens releases, or direct links which directed the users to a crypto scam trap.
He also said that the accounts frequently changed their usernames when a campaign was terminated and it was not easy to follow the same operators in various fraud cases. Using several accounts at once allowed the group to repeat the process across different topics, including politics, war news, and trending global events.
Large X accounts unknowingly boosted scam reach
The other factor that made the scheme successful is the use of bigger accounts that intertwined with the posts without the awareness that they were involved in a coordinated scheme. The visibility of replies, re posts, and quotes by the popular users boosted the content and pushed the content into the trending conversations during the sensitive news cycles.
ZachXBT referred to the technique as social engineering with account coordination by pointing out that negative postings tend to disseminate quicker than neutral or positive posts online. Because of that behavior, even a small number of accounts could generate massive reach before introducing a crypto scam promotion to unsuspecting followers.
He warned that the tactic becomes more dangerous during wars or political crises, when users are more likely to react emotionally instead of verifying information. That environment creates ideal conditions for scammers who want to hide fraudulent promotions inside fast-moving conversations about real world events.
On-chain data links accounts to pump scams
The investigator said blockchain analysis connected at least ten accounts in the monitored cluster to pump-and-dump token activity and coordinated promotions. He wrote that on-chain evidence showed the operators moved funds between wallets linked to the same campaigns, confirming the activity was organized.
According to his estimate, the crypto scam operation generated profits in the six-figure range, proving the strategy was not random spam but a planned fraud system. Several of the accounts promoted low-liquidity tokens that quickly dropped in price after sudden spikes driven by social media hype.
The pattern matched earlier investigations where engagement farming was used to build trust before directing followers toward risky or fake investments. ZachXBT said the same method has appeared repeatedly in past cases involving influencer accounts, meme coins, and coordinated dumping schemes.
Fake personas used to push crypto scam tokens
One example highlighted in the thread involved an account using the name “Rashid bin Saeed,” which posted viral claims about possible attacks on civilian infrastructure. The account attracted hundreds of thousands of followers despite having recent verification status and multiple username changes within a short period.
Related profiles on messaging platforms were later seen promoting a small meme token called CHIBI, which had a market value of about $3.9 million. Market data showed the token dropped more than 23% in one day, a move consistent with pump-and-dump behavior often linked to crypto scam campaigns.
ZachXBT warned that such fake personas can quickly gain credibility by posting believable geopolitical content before switching to financial promotions. He said stronger moderation and legal action may be needed because coordinated manipulation on large platforms can easily turn viral posts into profitable fraud.
