On-chain investigator ZachXBT has reported a coordinated group of social media accounts that used war-related and political posts on X to direct users toward crypto scams.
Summary
- ZachXBT traced more than 10 X accounts using war panic posts to attract users into crypto scams.
- The network bought follower-rich accounts, reposted fear-driven content, then promoted fake giveaways and pump-and-dump tokens.
- On-chain data suggests the coordinated scam cluster earned six figures through misleading posts and social engineering.
His latest thread says the network included more than 10 accounts and relied on fear-driven content to gain reach during the ongoing Middle East conflict.
ZachXBT said the operators bought accounts that already had followers. They then began posting repeated negative updates about war and politics several times a day. The goal was to attract reactions from users who were already following fast-moving global events.
He described the pattern as a form of engagement farming tied to fraud. According to his thread, the accounts used emotionally charged posts to pull in views and replies. After gaining reach, the operators shifted attention toward scam content linked to crypto promotions.
ZachXBT said the scheme followed a clear sequence. The accounts would post alarming content, then use other linked accounts to repost the same messages and increase visibility. After that, they promoted fake giveaways or direct scam offers connected to crypto.
He added that the operators often changed usernames after running the campaigns. That step made the network harder to track and allowed the same accounts to appear unrelated over time. The use of several accounts also helped the group repeat the method across different topics and audiences.
Moreover, ZachXBT said some large X accounts replied to or interacted with the posts without knowing the source or purpose behind them. That activity gave the content wider exposure and helped it spread further across the platform.
He said the method relied on social engineering as much as account coordination. Users often react more quickly to negative or alarming posts, especially during war-related news cycles. That reaction can push a post higher in feeds and place scam promotions in front of more people.
On-chain data linked the network to crypto fraud
ZachXBT said 10 accounts in the monitored cluster promoted pump-and-dump crypto scams. He wrote that “on-chain evidence suggests the scheme profited six figures.” His statement tied the social media activity to financial gains rather than random spam.
He also warned about the broader risk of the tactic. ZachXBT wrote that “it’s scary to think about” how easily the same method could be used on a larger scale. He said platform manipulation should face bans and legal action because many users on X already fall for false information shared through coordinated posts.
