ZachXBT Exposes X Network Using War Panic to Push Crypto Scams

Highlights:

• Scammers are exploiting geopolitical crises to promote crypto scams.
• Over 10 X accounts used AI to mimic influencers for fraudulent promotions.
• The scheme generated six-figure profits through pump-and-dump crypto scams.

ZachXBT, a blockchain investigator, has linked a set of X accounts with a fraud scheme that combined war panic and token promotion. According to the thread, the network took advantage of fear-heavy posts regarding Iran and broader geopolitical tension to draw attention.

The Network Used War Panic Posts to Build Reach Fast

ZachXBT said that the group operated over 10 accounts with established follower bases. Instead of creating new accounts, the operators purchased old accounts and reused them. Thereafter, they shared alarming updates on the war and politics multiple times every day, making the content spread across X timelines quickly.

1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.

Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam… pic.twitter.com/uMjCSQUzwp

— ZachXBT (@zachxbt) March 23, 2026

In addition, the accounts recycled panic narratives to maintain a high level of engagement daily. ZachXBT claimed that the accounts frequently shared the same claims within minutes. They also reposted each other to create visibility and make the stories look convincing, and received millions of views without paying for that reach.

The thread featured one account, called Wang Laurent. ZachXBT claimed that the profile emulated the style of Mario Nawfal with AI-generated branding. He also mentioned that the account changed usernames 17 times and attracted almost 80,000 followers. That trend consequently suggested an attempt to conceal identity and recycle influence, maintaining the crypto scam.

Once Engagement Peaked, the Token Promotion Phase Began

After the accounts gained traction, the scheme changed to monetization. The same network was used to promote fake giveaways and to pitch direct tokens in the market. The 10 accounts simultaneously pumped the Solana meme coin ORAMAMA on 22 February. The token, however, was not mentioned again after this brief campaign.

On-chain evidence, according to ZachXBT, connected the social posts with six-figure gains. ZachXBT described the operation as a pump-and-dump operation and not random spam. The trend embraced the pattern of panic to promotion and then silence. This arrangement implied the planning, coordination and financial intentions.

The researcher also noted that the usernames were frequently changed following every campaign. Those moves allowed operators to conceal previous actions and be ready to make the next move. Since the accounts had followers, they appeared more convincing compared to new profiles, driving the crypto scam. As a result, the network could transition from news-like posting to token promotions with little friction.

The Crypto Scam Raises Bigger Questions for the Platform

The investigation brought fresh concerns about manipulation on X. ZachXBT argued that the process appeared easy, cheap, and replicable. ZachXBT cautioned that a similar structure would easily be used to generate propaganda, just like token fraud, extending the narrative past a set of accounts.

The researcher also noted that large accounts occasionally amplified the posts without being aware of it. They enhanced content by responding to sensational claims that they did not adequately vet. Meanwhile, community notes did not necessarily halt the expansion when the interest boomed. The trend was similar to previous engagement-farming strategies.

After ZachXBT published his thread, all 11 accounts reportedly blocked him at the same time. He said that the synchronized move suggested centralized control. ZachXBT added that X product chief Nikita Bier knew about the accounts. However, no immediate platform response appeared alongside the thread.

The crypto scam follows the ongoing debate over bots, AI spam, and creator incentives on X. Although the platform announced stronger anti-bot tools earlier this month, this case shows how fast coordinated networks still move.

We are rolling out more detection for automation & spam (and a lot more to come).

If a human is not tapping on the screen, the account and all associated accounts will likely be suspended—even if you’re just experimenting.

While we aim to support legitimate use-cases of agents,…

— Nikita Bier (@nikitabier) February 14, 2026