Walrus
Quantus
Pudgy Penguins
Bitway
Quant
Sui
Bitcoin
Crypto news investigator ZachXBT has exposed a coordinated network of accounts on X manufacturing viral panic about war and geopolitics to drive traffic toward crypto scams.
The investigation, published in a thread on March 23, 2026, identified more than ten accounts operating a scheme that combines engagement farming, fake giveaways, and pump and dump token promotion.
The operation follows a consistent playbook. Accounts are purchased with existing follower bases, then used to post alarming content about war and political developments multiple times per day.
Alternate accounts within the network repost content to artificially boost reach, causing posts to go viral with millions of views, thousands of likes, and daily replies.
Crypto News: How the Network Manufactured Viral Reach
ZachXBT shared the network’s strategy in detail. After purchasing accounts with established audiences, operators use AI-generated personas to create fake influencer identities.
One example he highlighted was the account @wanglaurentceo, which he described as an AI-created fake version of a known media figure, built on a purchased account with user ID 1804235884826333184.
Posts from these accounts focused heavily on exaggerated or false claims about the Iran conflict and Middle East geopolitics.
Related accounts in the cluster then reposted the content to push it further into algorithmic distribution.
ZachXBT noted that numerous large accounts in replies and quote posts amplified the content further by engaging with it.
Behind the public-facing panic posts, the same accounts hosted fake giveaways and promoted crypto pump and dump schemes.
The $ORAMAMA Scheme and On-Chain Evidence
On February 22, 2026, ten accounts across the identified cluster simultaneously promoted a token called $ORAMAMA.
The coordinated promotion ran across multiple accounts before going completely silent on the topic. This is a pattern consistent with a coordinated pump and dump operation where promoters exit positions once retail buyers have entered.
ZachXBT stated that on-chain evidence suggests the scheme generated six-figure profits. He added that the cluster appears to now be farming engagement once again, which he interpreted as preparation for another upcoming scam.
The $ORAMAMA case sits within an overall pattern of social-engineering-driven crypto theft that has accelerated in early 2026.
Data from Nominis’ February 2026 incident report shows roughly $49.3 million was lost across major crypto incidents that month.
In one case, an Ethereum user approved a malicious USDT allowance to a scam address, after which the attacker used transferFrom calls to drain approximately $337,000 from the wallet.
Another involved a victim signing multiple deceptive verification signatures in a spoofed interface, enabling attackers to drain millions in assets including SLVon and XAUt.
Monthly data from January 2026 tells a similar story. Protocol-level hacks accounted for around $86 million in losses, while phishing and social engineering pushed total monthly theft toward $370 to $400 million.
In February, confirmed hack losses dropped to approximately $26.5 million across 15 attacks by some trackers. However, broader estimates place total February losses between $35.7 million and $49.3 million.
ZachXBT Calls for Platform Bans and Legal Action
ZachXBT published a table of user IDs for all 11 accounts in the cluster, including BinsaeedRashid, cn_redoracle, wanglaurentceo, bdcryptoguru, Whale_Guru, BaronDominus, ItsAnonApe, antmillionsbot, CNBlockIntel, sungleeiq, and rami_hashimi.
Several accounts had changed their usernames 3 to 40 times, a tactic used to evade detection and ban enforcement. Within hours of publication, all 11 accounts blocked ZachXBT.
