- A coordinated group of X accounts used fear-driven posts to attract users and redirect them to crypto scams.
- The network relied on AI personas, repost chains, and viral content to amplify reach and build credibility.
- A pump-and-dump scheme tied to ORAMAMA generated six-figure profits before the accounts moved on.
On-chain watchdog ZachXBT has revealed a coordinated social media network that uses fear-driven narratives to lure users into crypto scams.
The revelation has caused new questions about how easily online sentiment can be manipulated at scale. The network, which seems primarily run on X, consists of more than ten interconnected accounts. These profiles function in concert. They post high-volume content focused on geopolitical tensions, war scenarios, and breaking news themes. The intent is to grab attention right away, then channel that attention into fraudulent crypto schemes.
ZachXBT : Fake War News X Account Used for Crypto Scams
According to him, the operators begin by taking over existing social media accounts that already have a follower count. This gives them an immediate reach. From there, they flood timelines with sensational posts, often several times a day. The tone is urgent. The content is designed to trigger emotional reactions.
1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.
Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam… pic.twitter.com/uMjCSQUzwp— ZachXBT (@zachxbt) March 23, 2026
Once posted, the material is amplified through a network of alternate accounts. These accounts repeatedly repost and engage with each other’s content. The strategy works. Posts gain traction fast. Many reach millions of views within hours.
In several instances, the network also deployed fabricated online personas. One example highlighted by ZachXBT involved a fake profile styled as an “Asian version” of a well-known crypto commentator. The persona appeared credible at first glance. It was active, responsive, and embedded within ongoing discussions. Over time such accounts helped build trust among unsuspecting users.
Behind the scenes, however, the operation had a clear financial motive. Once engagement reaches its peak, the accounts start promoting fake links. These included fake airdrops, giveaway campaigns, and token promotions. Users were encouraged to click, connect wallets, or participate in what appeared to be legitimate opportunities.
One of the most visible campaigns tied to the network involved a token called ORAMAMA. On February 22, 2026, multiple accounts within the cluster promoted the asset aggressively. The campaign was short-lived. After a brief surge in interest, the crypto disappeared from their feeds. On-chain data suggests the operation made profits in the six-figure range before being abandoned.
The scale of the activity was amplified further by unintended participation from legitimate users. Several high-profile accounts engaged with the posts, either by replying or resharing them. This implies adding another layer of visibility. It also made the content appear more credible, drawing in a wider audience.
ZachXBT described the approach as a combination of traffic farming, AI-generated content, and coordinated amplification. The approach is relatively simple to replicate. That is part of the concern. The same framework could be used for more than financial scams. It could also sway public opinion if used with different intent.
ZachXBT has called for stronger rules from social media platforms. He argues that coordinated manipulation should lead to social media account bans and legal consequences. Without stricter surveillance, such networks are likely to continue and expand.
ZachXBT added an update, “All 11 of the mentioned accounts just blocked me (almost as if they’re operated by one person)”.
Also Read: ZachXBT Exposes Alleged Insider Trading and Data Abuse at Axiom
Credit: Source link