On September 18, 2024, a wave of high-profile account compromises on X (formerly Twitter) demonstrated the persistent threat that social engineering poses to the cryptocurrency community. Multiple well-known accounts, including those of Lenovo India and Yahoo News UK, were hijacked to promote a fraudulent memecoin called HACKED, exposing critical vulnerabilities in how social media platforms secure high-reach accounts.
Blockchain investigator ZachXBT was among the first to flag the coordinated attack, alerting the community that several large accounts had been compromised and were actively posting links to the fake token. Despite the significant reach of these accounts — collectively followed by millions of users — the scammers managed to extract only approximately $8,000 worth of cryptocurrency before the scheme was identified and publicized.
The Exploit Mechanics
The attack followed a familiar pattern that has plagued the crypto community for years. The threat actors gained unauthorized access to verified corporate and media accounts, likely through compromised third-party application permissions. Once inside, they posted promotional content for the HACKED token across multiple high-profile feeds simultaneously, creating an artificial sense of legitimacy through the sheer volume of trusted sources appearing to endorse the coin.
ZachXBT noted that the compromised accounts likely all granted permissions to the same malicious third-party application or website. This is a common attack vector where users authorize a seemingly legitimate app to access their X account, inadvertently giving attackers the ability to post on their behalf. The mechanism is deceptively simple: users click through OAuth prompts without carefully reviewing what permissions they are granting.
The HACKED token itself was designed to capitalize on the spectacle of account hacks, creating a twisted meta-narrative where the hack became the marketing. At its peak, the token reached a market capitalization of approximately $67,000 before collapsing as the community raised alarms.
Affected Systems
The primary targets were high-follower corporate and media accounts on X. Lenovo India, with its substantial technology-focused following, and Yahoo News UK, with its broad mainstream audience, represented ideal distribution channels for the scam. By leveraging established media brands, the attackers bypassed the initial trust barrier that typically protects users from unknown token promotions.
This incident is part of a broader pattern of social media account compromises in the crypto space. Just weeks earlier, French football star Kylian Mbappé’s account had been similarly hijacked to promote a fictional cryptocurrency. The recurring nature of these attacks highlights systemic weaknesses in how social media platforms handle account security, particularly for accounts with large followings that could influence market behavior.
The Mitigation Strategy
For individual users, the primary defense against these scams is a combination of skepticism and proactive security hygiene. ZachXBT recommended that users regularly audit and revoke third-party application permissions on their social media accounts. Many users accumulate dozens of authorized applications over years of platform use, creating an ever-expanding attack surface.
Organizations should implement hardware-based two-factor authentication for all social media accounts, restrict access to a minimal number of authorized personnel, and maintain active monitoring for unauthorized posts. The use of dedicated social media management platforms with enhanced security controls, rather than granting direct account access to multiple team members, can significantly reduce the risk of credential compromise.
Platforms like X must also bear responsibility. Enhanced detection of mass simultaneous posts promoting the same token, particularly from previously unrelated accounts, could serve as an early warning system. Rate limiting promotional content from newly authorized applications would provide an additional layer of protection.
Lessons Learned
The HACKED memecoin incident reinforces several critical security principles. First, the credibility of a post is only as strong as the verification that the account holder actually authored it. Even verified accounts with blue checkmarks can be compromised. Second, the relatively small financial gain — just $8,000 from accounts with millions of combined followers — suggests that the crypto community is becoming more vigilant, though not immune. Third, third-party application permissions remain one of the most underappreciated attack vectors in social media security.
User Action Required
Users should immediately review and revoke unnecessary third-party app permissions on their X accounts through the platform’s security settings. Enable hardware-based two-factor authentication using a security key rather than SMS. Report any suspicious promotional content, even from verified accounts, and never invest in tokens promoted exclusively through social media posts without independent verification from multiple trusted sources. The crypto market cap stood at approximately $2.10 trillion on this date, with Bitcoin trading around $61,650 — a reminder that even in a mature market, social engineering remains the most effective attack vector.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research before making investment decisions.
Lenovo India and Yahoo News UK combined have millions of followers and the scammers only made 8k. crypto grifters are getting worse at their job
Pontus L. 8k is actually the scary part. it means the real money is in smaller coordinated hits across hundreds of accounts that nobody monitors. ZachXBT only catches the big ones
scam_track_ the $8k being small change is the real insight. the big money is in slow drains across hundreds of verified accounts that nobody watches
Pontus L. $8k from millions of impressions actually proves the scammers were incompetent. a decent snipe with that reach would pull 500k+. zachxbt response time saved the community millions here
only $8k stolen despite millions of followers reached. either the scammers were amateurs or the HACKED token was so obviously fake that even normies smelled it
verified accounts with millions of followers getting hacked for only 8k shows these scammers dont even know how to scam properly
Lenovo India and Yahoo News UK getting hijacked to shill a memecoin called HACKED is peak 2024 irony. the scammers named their token after the crime
Florian W. the HACKED token name was marketing not humor. it got press coverage specifically because of the name. the scammers understood virality better than the security teams did
most people have 20+ OAuth apps connected and never audit them. X charges 1000/mo for gold checks but no security
the fact that verified corporate accounts still dont have hardware key requirements in 2024 is embarrassing. X charges 1000/month for gold checks but cant enforce 2FA
Kira N. X charges how much for gold checks and still no mandatory hardware keys. the ROI on a $1000/month verified account getting hacked is brutal
the HACKED token name is genuinely the funniest part of this whole thing. scammers with a sense of humor
celine_r the humor aside, lenovo india has 2M+ followers and x gave them zero extra protection. verified status is a revenue stream not a security feature
lenovo india and yahoo news uk accounts with millions of followers and they only extracted 8k. even scamming requires competence
scam_detective nailed it. millions of followers and they couldnt even break five figures. the crypto community flags this stuff faster than platform security teams do
8k from millions of impressions is actually a testament to how fast zachxbt and the community responds. used to be hundreds of thousands before CT got organized
third-party app permissions are a nightmare. most people never audit what has access to their accounts
Leila B. third party app permissions are the silent killer. most people connected to 20+ OAuth apps in 2024 and never cleaned them up. X doesnt even show you the list without digging through settings
Leila B. is spot on. most people have no clue how many apps have access to their X account. its been a vector since 2018 and nothing changed
most people dont even know how to check their connected apps. x needs a mandatory permission audit notification, would cut these attacks in half
token_opsec_ mandatory permission audits would help but x wont build it. they cant even moderate regular spam let alone third party app abuse
zachxbt stays saving the community. man deserves a medal at this point
deadcatbounce zachxbt really is the unpaid security team for all of crypto. man catches scams faster than the platforms themselves
8k from accounts with millions of followers is honestly impressive community response. zachxbt plus CT flags this stuff faster than platform trust and safety teams
zachxbt catching scams faster than platform security teams should be the model for every crypto project
8k stolen from accounts reaching millions of people. zachxbt community response is the only reason it wasnt 800k