A network of more than 10 social-media accounts used war-related content to funnel users into fraudulent crypto promotions, according to on-chain investigator ZachXBT. In a thread on X, he outlined how the group coordinated during the ongoing Middle East conflict to attract attention and redirect it toward scams tied to crypto assets.
1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.
Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam… pic.twitter.com/uMjCSQUzwp— ZachXBT (@zachxbt) March 23, 2026
The operator(s) built a pipeline by acquiring pre-existing accounts with sizable followings and then posting frequent updates centered on negative or alarming war and political developments. The posts, published several times a day, were designed to spark quick reactions and push the accounts into high-traffic conversations without relying on credible or verified information. ZachXBT described the tactic as engagement farming connected to fraud, aimed at generating replies, reposts, and broader visibility that could later be steered toward fraudulent campaigns.
The network’s pattern was iterative. First, attention-grabbing posts linked to conflict narratives appeared. Then connected accounts amplified the same content through reposts to widen reach. As engagement climbed, the operators introduced scam messaging, including fake giveaways or direct crypto promotions. The approach became more subtle over time, making the transition from news-like posts to scam content less noticeable to casual observers. The operators frequently changed usernames, hindering tracking and allowing the same profiles to re-emerge under new identities. The use of multiple accounts enabled the group to reproduce the process across different topics and audiences.
Some larger accounts on X interacted with the posts without clear awareness of origin or intent, further boosting visibility through replies and reposts. The method leaned heavily on social engineering: during conflict-driven news cycles, negative or urgent updates trigger rapid responses, increasing the likelihood that content trends and surfaces in feeds. That dynamic broadens the audience for scam promotions embedded within these engagement cycles.
On-chain data linked the network to pump-and-dump crypto schemes. ZachXBT identified ten accounts within the cluster as active promoters, and on-chain evidence suggests the operation generated six-figure profits. The findings demonstrate a direct financial payoff tied to coordinated social-media activity rather than isolated spam. The thread outlining these observations is available here: ZachXBT thread.
Key takeaways
- Price action: Not disclosed; no direct market move documented in connection with this activity.
- Catalyst: War-related engagement farming that channels followers from conflict coverage into fraudulent crypto promotions; network of more than 10 accounts; on-chain data tied to six-figure profits; ten accounts identified as active promoters.
- Key implication: Highlights vulnerabilities in social-media ecosystems to coordinated fraud; raises consumer risk from misrepresented promotions; potential regulatory and platform responses to curb manipulation.
What drove the move
According to ZachXBT, the operation began with attention-grabbing posts tied to conflict narratives, designed to spark reaction and broaden reach through interconnected accounts. These posts were followed by a staged shift to scam messaging, including fake giveaways or direct crypto promotions. The group relied on frequent username changes to evade tracking and to reuse the tactic across diverse topics and audiences. The model leverages social engineering, as heightened emotions and urgency around ongoing war coverage tend to elicit rapid engagement, increasing the likelihood that content surfaces in feeds and gains traction.
Market reaction
There is no reported price move tied to this campaign. Nonetheless, the episode emphasizes ongoing concerns about misinformation and manipulated narratives within crypto markets and social platforms. The linking of on-chain profits to coordinated social-media activity underscores how online engagement can translate into tangible financial outcomes for scammers. The network involved at least ten accounts actively promoting the schemes, illustrating a measurable financial footprint behind what may appear as opportunistic spam.
Bigger picture
The episode highlights how coordinated engagement strategies can scale beyond traditional spam and into paid-promotions ecosystems that leverage significant audience reach. It raises questions for platform operators about authenticity signals, moderation, and enforcement, as well as for regulators evaluating crypto-promotion practices on social media. The case aligns with broader themes around digital trust and the challenges of policing misinformation in fast-moving news cycles that intersect with financial markets.
Closing
Watch for responses from social platforms and regulatory authorities as they reassess tools and policies to curb fraudulent campaigns tied to high-visibility news events. Developments in platform moderation, on-chain analytics, and enforcement actions could influence how similar campaigns are detected and mitigated in the crypto ecosystem.
