The breach, confirmed by X user Tischersauce on October 29, allowed the attackers to promote a questionable memecoin and generate over $600,000 in profits.
Can you atleast shill an actual good coin like $pumpi the mascot of @pumpdotfun ?
5V9HBdoEpcLP5mGKi6onhUbp4Mkdzo8oeCXtArLCpump
— Tischer ???? (@tischersauce) October 29, 2024
How the hack happened
The incident began around 1:50 a.m. UTC when the compromised Truth Terminal account posted a cryptic message introducing a new token, Infinite Backrooms (IB), along with an image showing the contract address.
The announcement quickly spurred IB’s valuation to $25 million as users bought into the token. Data from Descreener reveals that the wallet responsible for launching IB initially purchased 124.6 million tokens for $38,400 and then sold them all within 45 minutes, earning a profit of $602,500.
Related: XRPL Debate Highlights XRP’s Future Role Alongside Stablecoins in Payments and DeFi
As of press time, the promo post has been deleted but Ayrey’s account still appears to be under the control of hackers, who continue to post promotional content about new tokens and share links to Telegram groups.
Truth Terminal is a well-known AI bot in the crypto community. It was created using Meta’s Llama 3.1 language model, and it is managed semi-autonomously, with Ayrey overseeing its posts on X.
It had previously promoted Goatseus Maximus (GOAT), a memecoin that reached a valuation of $940 million before dropping to a $637 million market cap. Truth Terminal was not involved in launching GOAT but endorsed it after its creation on the Solana platform Pump.fun on October 10.
The AI bot’s influence grew significantly after receiving $50,000 in funding from Marc Andreessen, a16z founder, in July, allowing the bot to expand its capabilities and explore new projects.
Meanwhile, this breach follows a similar incident on October 18, when the X account of DeFi protocol EigenLayer was compromised to promote a fake airdrop. The attackers shared a message resembling an official campaign update, redirecting users to a malicious website posing as an airdrop claim portal.
X-based Memecoin has continued in 2026
In July 2026, Robinhood CEO Vlad Tenev said his X account had been compromised through a social-engineering attack targeting X customer support. The attacker used the account to promote a fraudulent token called Vladhood. Tenev later said the attacker had bypassed standard protections, including two-factor authentication and login notifications, before the account was restored.
In both cases, attackers did not need to convince the market from scratch. They first obtained access to an account that already carried credibility, then used that credibility to create demand for a token.
The 2026 environment is even more favourable to this type of attack. Memecoin launchpads make it possible to create and distribute tokens rapidly, while traders monitor social media for signals that might give a new token an early advantage.
Researchers studying Solana memecoin launches in 2026 have also found that automated launchpads have become a dominant way of issuing these assets. A study covering more than 40,000 memecoins that migrated to public DEXs identified patterns involving trading activity, wallet concentration and coordinated accounts that can help identify high-risk launches.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
