ZachXBT Uncovers Coordinated Fake‑Account Network Pushing Crypto Scams on X
March 23 2026
A self‑described blockchain investigator known as ZachXBT published a detailed X thread on Monday that points to a sophisticated operation of more than ten interlinked accounts on the platform X (formerly Twitter). According to his analysis, the network exploits sensational war‑and geopolitics posts to attract massive engagement before switching to promote fraudulent cryptocurrency giveaways and pump‑and‑dump schemes.
How the scheme works
- Bootstrapped follower bases – The identified accounts already possessed sizable follower counts.
- Viral “doom‑posts” – They repeatedly posted exaggerated or misleading content about ongoing conflicts and political crises. The emotionally charged nature of these posts helped them trend quickly, generating millions of impressions.
- AI‑driven impersonation – Several profiles used generative‑AI tools to mimic well‑known crypto influencers, notably Mario Nawfal, lending an air of credibility to the posts.
- Shift to crypto bait – Once a post reached a peak in visibility, the operators appended links to fake token giveaways or promoted pump‑and‑dump tokens. One example cited by ZachXBT was a February 22 promotion for the token “Oramama.”
- Harvesting engagement – Replies and quote‑tweets from large accounts that unknowingly amplified the original post helped push the scam links further into users’ timelines.
ZachXBT’s on‑chain analysis suggests the operation generated six‑figure returns for its creators, and he warns that similar patterns are emerging, indicating a possible upcoming campaign.
Platform response
X has recently rolled out new anti‑bot and AI‑content detection measures. In early March, product chief Nikita Bier announced upgraded systems designed to flag automated spam, remove suspicious accounts, and label AI‑generated posts. Despite these enhancements, the ZachXBT findings illustrate how quickly a coordinated cluster of accounts can amass engagement before platform safeguards intervene.
Wider context
The incident adds to a growing body of evidence that fake accounts and automated bots remain a persistent threat across social‑media ecosystems, especially in the cryptocurrency space where hype‑driven marketing is common. Earlier reports have linked similar tactics to market manipulation, misinformation campaigns, and the distribution of illicit financial products.
Key takeaways
- Coordinated networks can masquerade as legitimate influencers using AI‑generated avatars, making it harder for users to discern authenticity.
- Geopolitical sensationalism is an effective hook for grabbing attention; scammers then pivot to crypto bait once a post is trending.
- On‑chain tracing can reveal profitability; in this case the scammers reportedly earned six figures before the scheme was exposed.
- Platform mitigation efforts are ongoing, but the speed at which coordinated accounts build momentum often outpaces detection tools.
- Users should verify account identities and scrutinize giveaway links—especially when the promotion follows a high‑profile or emotionally charged post.
What’s next?
ZachXBT has published a list of the X handles he believes are connected to the operation, urging the community to monitor any changes in usernames or account status. He also calls for stricter enforcement actions, including bans and potential legal recourse, against actors who manipulate social platforms for fraudulent financial gain.
The discovery underscores the need for heightened vigilance among crypto enthusiasts and for continuous improvement of detection mechanisms on social media platforms.
Cointelegraph maintains editorial independence and encourages readers to verify information through multiple sources. For our full editorial policy, visit https://cointelegraph.com/editorial‑policy.
Source: https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network?utm_source=rss_feed&utm_medium=feed&utm_campaign=rss_partner_inbound
