ZachXBT exposed a coordinated X scam network using over ten purchased accounts with computer-generated personas, like a fake Asian Mario Nawfal, to post sensational war/political content.
These accounts gained millions of views through cross-promotion before switching to their crypto scams. This can be proven by the “doomposts,” giveaways, and on-chain data showing the 10 accounts promoting the fake $ORAMAMA token on February 22, 2026. This earned the scammers six-figure profits. This is a prime example of how platform manipulation can lead to propaganda. This shows the importance of checking the accounts’ history because of the growing spam on social media platforms created by computer-generated accounts.
The scammers mainly targeted users looking for updates on geopolitical events in real time. They used verified accounts with a “blue check” to pretend to be legitimate sources. By creating a sense of urgency and panic, the scammers were able to evade the skepticism of many investors.
1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.
Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam… pic.twitter.com/uMjCSQUzwp— ZachXBT (@zachxbt) March 23, 2026
Coordinated accounts bypass X’s safety filters
However, according to the findings by ZachXBT, these accounts were not working in isolation. They were all working together to spread misinformation by boosting each other’s posts to manipulate X’s algorithm. Once a person interacted with the sensationalized content, they would be led to a fake website that would drain their crypto wallets when they made a connection.
The investigator also pointed out that although some accounts were suspended, there were others that remained active for weeks. They gained thousands of followers through paid promotions and bots. This enabled the syndicate to move from one trending topic to another. They moved from financial FUD to war-related triggers.
Rising trend of social engineering in Web3
Security analysts suggest that the human element, specifically the exploitation of emotional triggers like fear, remains the most significant vulnerability for decentralized finance participants. Also, the focus of digital asset security is shifting from purely digital threats to physical dangers, according to DeFi Planet, which highlights a significant rise in wrench attacks. In these incidents, criminals are employing real-world violence and coercion against individual cryptocurrency holders to bypass digital security measures and steal their funds.
Community members have expressed frustration over the perceived lack of oversight on X, noting that the Verified status is frequently bought by bad actors to gain unearned credibility. This atmosphere has forced users to rely increasingly on independent researchers like ZachXBT rather than the platform’s native reporting tools
Enjoyed this piece? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
