Key Takeaways
- An X account belonging to Amimoca Brands Chairman and co-founder Yat Siu was hacked.
- The compromised account was used to promote a fraudulent token.
- A single threat actor appears to be behind a string of similar incidents that have stolen around $500,000 in the last month.
Animoca Brands co-founder Yat Siu appears to be the latest victim of a prolific X hacker who has stolen around $500,000 in the last month promoting fraudulent tokens on compromised social media accounts.
Blockchain sleuth ZachXBT highlighted a network of blockchain addresses connecting tokens hawked from the X accounts of Siu and at least 15 other victims of email phishing attacks.
Influencers Targeted by Phishing Attack
Noting similarities between hacks that have affected a string of X users in recent weeks, ZachXBT concluded that the same threat actor compromised accounts belonging to Siu and Vanar CEO Jarad Ashraf.
Official accounts for Brett, Kick Streaming, and several Web3 gaming projects were also targeted.
In each case, the hacker used similar phishing emails to steal users’ credentials and breach their X accounts.
As in all effective phishing schemes, the fraudster applied pressure on their victims, convincing them the email was a legitimate alert from X warning them that their posts may have broken community guidelines.
After seizing control of the accounts, the attacker used them to promote fraudulent token schemes on the Solana-based decentralized exchange pump.fun.
The stolen funds were then transferred back and forth between Solana and Ethereum to obscure their source.
Crypto Projects Among Victims
The X accounts that the hacker targeted seem to have been carefully selected.
Official profiles for multiple crypto projects, including memecoin and NFT initiatives, were compromised, enabling the fraudster to exploit these accounts’ credibility and large follower bases.
This tactic allowed the hacker to maximize the reach of their scam campaigns, drawing in unsuspecting users and investors who trusted the accounts’ authenticity.
Lessons for the Crypto Community
The recent attacks highlight the need for increased vigilance within the cryptocurrency and blockchain sectors.
Both individual users and project teams must prioritize security to avoid falling victim to such schemes.
Simple steps such as enabling two-factor authorization (2FA), educating team members about phishing risks, and implementing robust email filters can reduce the likelihood of breaches.
Additionally, projects should establish contingency plans to address and mitigate damage in the event of a hack.
Acknowledging that Siu’s account had been compromised, Animoca Brands’ official X handle warned followers that: “there is no official token or NFT launch from Animoca Brands.”
“The token launch on Solana, as claimed in a post, was made by the hacker. Please DO NOT engage with the account and stay vigilant,” it added.
James Morales is CCN’s blockchain and crypto policy reporter. He has been working in the news media since 2020, writing about topics such as payments, banking and financial technology. These days, he likes to explore the latest blockchain innovations and the evolving landscape of global crypto regulation.
With an educational background in social anthropology and media studies, James uses his platform as a journalist to explore how new technologies work, why they matter and how they might shape our future.
