Audit log

Every state-changing event for AI Fake X Account Crypto Scam Network 2026: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-31 23:25:11Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   5Q1tGt1xm3r4…PAxTWpeXcopysha256 → base58

   verifying row…

   canonical bytes (20615 B) ▸

   {"actor":"system:backfill","investigation_id":"d6448c4e-2bbc-4df6-86ce-f90663e46898","kind":"publish","page_slug":"ai-fake-x-account-crypto-scam-network-2026","published_at":"2026-07-31T23:25:11.314Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AI Fake X Account Crypto Scam Network 2026","sections":[{"content":"On March 23, 2026, blockchain investigator ZachXBT published an investigation identifying a cluster of more than ten coordinated accounts on X operating as an engagement-farming and crypto fraud network. ZachXBT published a table of user IDs for all 11 identified accounts in the cluster, including handles @BinsaeedRashid, @cn_redoracle, @wanglaurentceo, @bdcryptoguru, @Whale_Guru, @BaronDominus, @ItsAnonApe, @antmillionsbot, @CNBlockIntel, @sungleeiq, and @rami_hashimi. The accounts were not organically grown; they were purchased with pre-existing follower bases to confer immediate credibility. One account, @BinsaeedRashid, which claimed to be based in the UAE but whose metadata suggested a US location, accumulated more than 353,000 followers and received X verification in February 2026. Multiple accounts cycled through numerous username changes to obscure tracking; @wanglaurentceo alone cycled through at least 17 usernames, including \"usdtt11,\" \"xrpinsol,\" and \"edtrumpofficial.\" Within hours of ZachXBT's publication, all 11 identified accounts blocked the investigator. X subsequently suspended all 16 accounts ZachXBT identified in the broader cluster.","heading":"Network Overview and Identification","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran news accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"ZachXBT on X: Ten accounts in the cluster all promoted $ORAMAMA on February 22, 2026","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},{"content":"The network's most novel characteristic was its use of artificial intelligence to fabricate believable influencer identities at scale. The account @wanglaurentceo, operating under the name \"Wang Laurent,\" was described by ZachXBT as an AI-generated fake Asian version of Mario Nawfal — a well-known Irish-Lebanese media personality and crypto commentator. Investigators assessed that the operators ran Nawfal's profile photo through an image generation tool to produce a visually distinct but thematically similar persona designed to borrow Nawfal's reputational capital among crypto audiences. The account accumulated approximately 79,900 followers before exposure. A second account, @cn_redoracle, operated as a purported Chinese breaking news outlet and republished fabricated geopolitical stories with near-identical wording to other cluster accounts, suggesting centralized content production. The combined effect of AI-generated profile images, fabricated personas, and purchased follower counts produced accounts that passed casual inspection. ZachXBT noted the infrastructure required to replicate this operation is minimal and low-cost, consisting of purchased aged accounts, off-the-shelf AI image generation, and coordinated cross-posting.","heading":"AI-Generated Persona Infrastructure","severity":"critical","sources":[{"credibility":2,"name":"Fake X Influencers Used AI and War Content to Drive Six-Figure Crypto Scam Profits — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/fake-x-influencers-used-ai-to-drive-crypto-scam/"},{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran news accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"}]},{"content":"Before monetizing their audiences, cluster accounts ran a sustained engagement-farming phase grounded in fabricated or heavily exaggerated war and geopolitical content. Posts exploited high-anxiety topics including alleged Iranian retaliatory strike lists targeting civilian infrastructure in Gulf nations, fabricated Cuba hospital blackouts and ventilator deaths attributed to US sanctions, and sensational US-Iran conflict narratives. Accounts posted multiple times per day and used coordinated cross-posting, with each account reposting content from others in the cluster to drive algorithmic amplification. The tactic was effective: posts generated millions of views, thousands of likes, and high daily reply volumes. Large legitimate accounts with no connection to the scheme inadvertently boosted fraudulent posts. The operation ran during an extended period of elevated crypto market fear — a Crypto Fear and Greed Index reading of 8 was recorded around the time of peak activity — which ZachXBT assessed made the doom-posting more psychologically effective with target audiences. The use of fear-inducing geopolitical content as an engagement precursor to crypto fraud is documented in ZachXBT's thread as a deliberate, repeatable playbook rather than opportunistic posting.","heading":"Engagement Farming Methodology: Geopolitical Fear Content","severity":"high","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Social Media Network Using Fake News to Promote Crypto Scams — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-exposes-social-media-network-using-fake-news-to-promote-crypto-scams"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"}]},{"content":"The network's documented monetization event occurred on February 22, 2026, when ten accounts within the cluster simultaneously promoted the meme token $ORAMAMA. The coordinated simultaneous promotion across accounts with a combined audience in the hundreds of thousands is consistent with a pre-arranged pump-and-dump structure. After the promotional push, none of the accounts mentioned $ORAMAMA again — a cessation pattern ZachXBT identified as indicative of post-dump disengagement. On-chain evidence cited by ZachXBT indicated the scheme generated six-figure profits in US dollar terms, though the investigation did not publicly name the specific wallet addresses or total transaction volume in reporting covered by secondary sources. ZachXBT's thread noted that as of publication the accounts appeared to be in a renewed engagement-farming phase, suggesting preparation for a subsequent monetization event. The $ORAMAMA promotion represents one documented monetization cycle; the full scope of the network's fraudulent token activity across its operational history was not quantified in available reporting.","heading":"$ORAMAMA Pump-and-Dump: On-Chain Evidence","severity":"critical","sources":[{"credibility":2,"name":"On-Chain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"on_chain","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ZachXBT on X: Ten accounts in the cluster all promoted $ORAMAMA on February 22, 2026","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"}]},{"content":"Following ZachXBT's March 23, 2026 publication, all 11 of the initially named accounts blocked ZachXBT's profile in a coordinated fashion, which the investigator interpreted as an indicator of ongoing monitoring of threat researchers by the network operators. X subsequently suspended all 16 accounts identified in ZachXBT's broader cluster. Nikita Bier, X's head of product, acknowledged concerns about platform manipulation and announced enhanced anti-bot detection measures and AI-generated content flagging in response to the exposure. ZachXBT separately called for platform bans and potential legal consequences for coordinated manipulation of this kind. No criminal charges or regulatory actions against the network operators had been publicly reported as of the date of available sources. The rapid suspension of accounts following public exposure, rather than proactive detection, drew criticism regarding X's capacity to identify coordinated inauthentic behavior without external reporting.","heading":"Platform Response and Account Suspension","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"}]},{"content":"ZachXBT explicitly flagged the nation-state implications of the playbook, stating: \"It's scary to think about the implications if a nation-state actor operated the same scheme rather than a meme-coin scammer.\" The concern centers on the infrastructure's low cost and high scalability: purchased aged accounts, commodity AI image generation, and coordinated posting require minimal resources but can drive mass psychological manipulation through algorithmically amplified disinformation. The network demonstrates that AI-enabled influence infrastructure previously associated with state-linked information operations has been commoditized and adopted by financially motivated criminal actors in the crypto space. Industry context from TRM Labs documents a 456 percent surge in generative-AI scam activity between May 2024 and April 2025. Chainalysis reporting indicates approximately 60 percent of all deposits into scam wallets in the same period came from operations using AI tools. The $ORAMAMA network's methodology — AI personas, fabricated news, coordinated amplification, rapid monetization — is consistent with this documented industry-wide trend. No law enforcement or regulatory body had formally attributed the operation or filed charges as of available reporting.","heading":"Nation-State Threat Vector and Broader Implications","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":3,"name":"Most Dangerous AI Crypto Scams of 2026 and How to Spot Them — Bitunix","type":"other","url":"https://blog.bitunix.com/en/most-dangerous-ai-crypto-scams-and-how-to-spot-them/"}]},{"content":"The $ORAMAMA network operates within a documented and rapidly expanding category of AI-assisted crypto fraud. Finance Complaint List data cited in industry reporting describes a 500 percent surge in AI-powered deepfake crypto scams driven by celebrity impersonation between 2024 and 2025. A separate documented case from June 2024 involved a deepfake video of Elon Musk in a live YouTube broadcast promoting a fake cryptocurrency giveaway; the associated scam wallet collected an alleged minimum of $5 million within 20 minutes. The SEC charged seven entities — including AI Wealth Inc. and AI Investment Education Foundation Ltd. — in a $14 million fraud scheme in which operators recruited victims via social media and used claimed AI investment tools as a credibility mechanism. Impersonation scams grew an alleged 1,400 percent year-over-year in 2025, becoming the fastest-rising category of crypto fraud. The X-based engagement-farming model documented by ZachXBT represents a distinct variant: rather than deepfake video or direct investment solicitation, it uses AI-generated static personas combined with fear-content virality to build audiences before extracting value through low-liquidity token promotions.","heading":"Broader AI Impersonation Scam Landscape","severity":"high","sources":[{"credibility":1,"name":"SEC Charges Fake Crypto Platforms, AI Investment Clubs in $14M Scam — Yahoo Finance","type":"regulatory","url":"https://finance.yahoo.com/news/sec-charges-fake-crypto-platforms-120656665.html"},{"credibility":3,"name":"Finance Complaint List Warns of 500% Surge in AI-Powered Deepfake Crypto Scams — Digital Journal","type":"news_article","url":"https://www.digitaljournal.com/pr/news/vehement-media/finance-complaint-list-warns-500-1235625427.html"},{"credibility":2,"name":"What Crypto's Impersonation Surge Means for Every Brand — Allure Security","type":"research","url":"https://alluresecurity.com/blog/crypto-impersonation-surge-warning-every-brand/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran news accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"Fake X Influencers Used AI and War Content to Drive Six-Figure Crypto Scam Profits — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/fake-x-influencers-used-ai-to-drive-crypto-scam/"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"ZachXBT on X: Ten accounts in the cluster all promoted $ORAMAMA on February 22, 2026","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"On-Chain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"on_chain","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"},{"credibility":1,"name":"SEC Charges Fake Crypto Platforms, AI Investment Clubs in $14M Scam — Yahoo Finance / SEC","type":"regulatory","url":"https://finance.yahoo.com/news/sec-charges-fake-crypto-platforms-120656665.html"},{"credibility":2,"name":"ZachXBT Exposes Social Media Network Using Fake News to Promote Crypto Scams — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-exposes-social-media-network-using-fake-news-to-promote-crypto-scams"},{"credibility":2,"name":"What Crypto's Impersonation Surge Means for Every Brand — Allure Security","type":"research","url":"https://alluresecurity.com/blog/crypto-impersonation-surge-warning-every-brand/"},{"credibility":2,"name":"ZachXBT Exposes War Panic-Fueled Scam Network on X — The Coin Republic","type":"news_article","url":"https://www.thecoinrepublic.com/2026/03/23/crypto-news-zachxbt-exposes-war-panic-fueled-scam-network-on-x/"}],"summary":"A coordinated network of more than ten AI-powered fake accounts on X (formerly Twitter) was exposed by on-chain investigator ZachXBT on March 23, 2026. The operation purchased aged accounts with existing follower bases, deployed AI-generated personas impersonating real influencers including Mario Nawfal, and flooded the platform with fabricated war and geopolitical panic content before pivoting to pump-and-dump token schemes and fake giveaways. On-chain evidence documented in the investigation indicates the network generated six-figure profits, primarily through coordinated promotion of the $ORAMAMA token on February 22, 2026.","timeline":[{"date":"2026-02-01","event":"Cluster accounts believed to have begun or intensified engagement-farming phase, posting fabricated geopolitical content multiple times daily to build audience reach","source":"CoinTelegraph / ZachXBT investigation thread","source_url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"date":"2026-02-01","event":"@BinsaeedRashid account, with 353,000+ followers, received X verification, lending additional false credibility to its fabricated persona","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"date":"2026-02-22","event":"Ten accounts in the identified cluster simultaneously promoted the $ORAMAMA meme token in a coordinated pump-and-dump event; on-chain evidence subsequently indicated six-figure profits; accounts never mentioned the token again after this date","source":"ZachXBT on X / Blockchain.news","source_url":"https://x.com/zachxbt/status/2035989271652466773"},{"date":"2026-03-23","event":"ZachXBT published a detailed investigation thread on X exposing the 11-account coordinated network, providing on-chain evidence, account history analysis, and AI persona documentation","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"date":"2026-03-23","event":"All 11 named accounts blocked ZachXBT within hours of publication in a coordinated response","source":"CoinEdition","source_url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"date":"2026-03-23","event":"X suspended all 16 accounts identified in ZachXBT's broader investigation cluster following publication","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"date":"2026-03-23","event":"X product head Nikita Bier announced enhanced anti-bot detection and AI-generated content flagging in response to the exposure","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 72f01db5-d6cc-48e0-8c41-d6b5a9235b4acopy