Prominent blockchain detective ZachXBT has uncovered a hacking spree targeting popular accounts on X and Instagram, which fueled a wave of pump-and-dump schemes linked to meme coins launched on Pump.fun.
Celebrities such as musicians Usher and Wiz Khalifa, actor Dean Norris, as well as a Japanese public aquarium fell victim to these attacks.
Hacks Targeting Celebrities, Big Brands
In a detailed thread on X, ZachXBT revealed that social media account takeovers (ATOs) started in August 2024. Each incident followed a similar pattern: first, accounts were breached; then bogus tokens were promoted; and finally, the proceeds from the token sales were moved to anonymous wallets.
Most of the attacks ZachXBT documented were connected, with funds made from one operation used to deploy and snipe another fake meme coin that was shilled on a compromised social account.
Global fast food giant McDonald’s was among the first casualties, with its Instagram account hacked and used to promote the GRIMACE token. That particular operation netted the bad actors about $690,000, which was quickly consolidated into two wallets.
Soon after, the criminals compromised Dean Norris’s X account and used it to promote SCHRADER. The meme coin was a nod to popular culture, as it was named after a character the actor played in the hit TV show “Breaking Bad.”
Connected Operations
Eight-time Grammy Awards winner Usher’s account was used to shill the USHER coin, with 110 SOL used to snipe it coming from the same address that received the funds reaped from the McDonald’s attack.
The money made from the USHER scam, about 4868 SOL, was then deposited into a wallet that was later connected to subsequent attacks on the Enoshima Aquarium and Truth Terminal creator Andy Ayrey’s social accounts.
The attack on Ayrey’s account was particularly brazen. The exploiters promoted six different meme coins over several days, including RNA, TRUTH, INFINITY, and WOAH. They reportedly made more than $2.1 million from these tokens and deposited $750,000 of that amount into a casino address.
The last recorded incident was on November 3, when Wiz Khalifa’s X account was compromised and used to promote two meme coins, WIZ and WIZZLE. ZachXBT directly linked the Wiz Khalifa ATO to the Ayrey incident and another scam that took over the Instagram account of the owner of Kabosu, the famous Shiba Inu that inspired the Dogecoin branding and used it to promote the fake KAI token.
In total, unsuspecting investors reportedly lost at least $3.5 million, with social media platforms struggling to contain the damage. ZachXBT has promised to reveal the identities of those behind the compromises later today.
