Hackers target crypto influencer X accounts, shill meme coins

Share this article

Over the weekend, a series of hacks compromised several X accounts from crypto influencers and celebrities to promote a number of coins, resulting in short-lived price surges.

One of the most prominent targets was GCR, whose account was compromised on May 26. After the initial intrusion, the hacker was able to post promotional content on ORDI and Luna2.0, causing momentary price increases of 6% and 274% for the tokens. Observers noted that the hacker could have chosen to promote a microcap coin for more significant gains, rather than the relatively established ORDI, which already has a market cap of $856 million.

Udi Wertheimer, a Bitcoin dev and Ordinals supporter, warned that the incident with GCR may not be an isolated case. It appears that this was part of a broader operation targeting celebrity X accounts, such as mumble rapper Rich the Kid and media personality Caitlyn Jenner.

For the former, a new token called $RICH on the Solana meme coin creation platform pump.fun. No official confirmation from Rich the Kid’s management team has been posted, although the post has already been deleted. Current market cap for this coin has stagnated at $144K, data from dexscreener indicates.

As for Jenner’s account, a meme coin named $JENNER was also promoted, moving the coin’s market capitalization to $25 million, according to aggregated data from Raydium and GeckoTerminal.

According to analysis from deepfake security service IdentifAI, the content posted from Jenner’s X account is AI-generated, suggesting a probable hack. The study was conducted through audio comparison, with findings that show a high degree of similarity between posts.

“We believe the attackers used the same voice cloning technology to produce this AI-generated audio, leading to the observed high similarity between the samples,” shares Paul Vann, CTO at IdentifAI.

Aside from synthetic similarities in voice, the analysis also found “non-natural eyebrow movements” from the initial video [removed or flagged from X], which differ from the second video. These semblances and variations support IdentifAI’s claim that the $JENNER shill videos are AI-generated. Below, you view a heatmap of the study shared with Crypto Briefing.

Despite videos of Jenner assuring followers that the posts are genuine, industry experts believe the account has been compromised. Interestingly, the crypto wallet address posted by Jenner matches the one used by adult content creator Kazumi, whose account was hacked on May 20 to promote the “ZUMI” coin.

No data regarding the threat actor’s identity has been disclosed at the time of writing, while no particular entity has claimed responsibility for the hacks, and whether these are connected or related to a singular hacker or group has not been established.

Share this article