{"investigation":{"slug":"nelly","entity_name":"Nelly","trust_score":40,"severity_base":null,"score_modifier":-8,"confidence":1,"status":"published","content_type":"investigation","summary":"Rapper Nelly (Cornell Iral Haynes Jr.) is flagged here not as a perpetrator of crypto fraud, but as a victim of an account compromise. In October 2023, an X (formerly Twitter) account associated with Nelly — handle @NellioETH — was hacked by an unknown third party who then used it to run a social engineering phishing campaign against crypto users. Blockchain investigator ZachXBT first identified and publicized the incident; specific amounts stolen from victims and detailed on-chain forensics have not been publicly confirmed.","sections":[{"content":"On or around October 18, 2023, an X account associated with rapper Nelly, operating under the handle @NellioETH, was compromised by an unknown threat actor. The account had approximately 3.5 million followers, giving attackers a large potential audience. Following the compromise, the account was repurposed to impersonate a security analyst affiliated with Scam Sniffer, a legitimate on-chain phishing-detection service. Multiple crypto news outlets including The Block, Crypto.news, and CryptoPotato reported on the incident the same day. The @NellioETH handle was subsequently suspended or deleted by X; at the time of reporting, the account no longer existed.","heading":"Account Compromise Overview","sources":[],"severity":"medium"},{"content":"After taking control of the account, the attacker adopted the persona of a Scam Sniffer security representative and sent direct messages to users — specifically targeting individuals with known .eth wallet addresses. The messages falsely claimed to be investigating malicious spWETH approval transactions on the recipient's wallet and directed victims to a phishing site designed to mimic the legitimate scamsniffer.io domain but using a different top-level domain. Once victims interacted with the phishing site, they were prompted to sign transactions presented as 'full signature revokes.' In reality, these signatures authorized the transfer of funds to attacker-controlled wallets. Scam Sniffer publicly denied any affiliation with @NellioETH and confirmed the account was fraudulent. ZachXBT reported that one victim lost 93.24 ETH (approximately $145,000 at the time) and a separate incident in the same broader phishing wave saw 299.49 rETH (approximately $534,000) drained; however, it is not confirmed in available public sources that these specific losses are directly attributable to the @NellioETH phishing campaign specifically, as opposed to the broader phishing wave occurring in October 2023.","heading":"Scam Mechanics","sources":[],"severity":"medium"},{"content":"ZachXBT, the pseudonymous blockchain investigator, was the first to publicly identify and alert the community to the compromise via his Telegram investigations channel. ZachXBT cited direct messages sent by the attacker as evidence of the social engineering campaign, reproducing message content that showed the scammer claiming to investigate wallet compromise and directing users to sign revoke transactions. Scam Sniffer corroborated ZachXBT's findings, posting on X that '@NellioETH is compromised and pretending to be a member of ScamSniffer' and urging users to only trust scamsniffer.io. No detailed on-chain forensics or wallet tracing specific to the @NellioETH campaign have been published in sources identified by this investigation. The depth of ZachXBT's on-chain analysis beyond the initial alert is not confirmed in available public reporting.","heading":"ZachXBT's Investigation","sources":[],"severity":"medium"},{"content":"The @NellioETH incident is one instance within a documented broader pattern of threat actors compromising high-follower celebrity accounts on X to conduct crypto fraud. A separate and larger campaign identified by ZachXBT in 2024 involved account takeovers of celebrities including Usher, Wiz Khalifa, and actor Dean Norris, as well as the McDonald's Instagram account, resulting in alleged losses of at least $3.5 million from pump-and-dump meme coin schemes on Pump.fun. That investigation led ZachXBT to allege involvement by a former professional Fortnite player known as 'Serpent.' The 2023 Nelly hack and the 2024 celebrity meme coin scheme appear to be separate incidents; no public source links them to the same perpetrator. Scam Sniffer reported that crypto phishing attacks across 2023 drained approximately $295–$300 million from over 324,000 victims industry-wide.","heading":"Broader Pattern: Celebrity Account Hacks for Crypto Scams","sources":[],"severity":"medium"},{"content":"This investigation carries a weak_evidence tag. Available public reporting is predominantly based on secondary crypto news outlets (Tier 2) relaying ZachXBT's Telegram post; no primary court filings, regulatory actions, or detailed on-chain analytics reports have been identified for this specific incident. The amounts cited ($145K and $534K) appear in one source but are attributed to the broader phishing wave of that period rather than confirmed losses from the @NellioETH campaign specifically. No criminal charges, law enforcement actions, or identified suspects have been publicly reported in connection with the Nelly account hack. The trust score and confidence scores in this report reflect these limitations. Nelly himself is assessed as a victim of an account compromise, not as a knowing participant in crypto fraud.","heading":"Evidence Quality and Confidence Limitations","sources":[],"severity":"medium"}],"timeline":[{"date":"2023-10-18","event":"X account @NellioETH, associated with rapper Nelly, is compromised by an unknown threat actor. ZachXBT identifies and publicly reports the phishing campaign via Telegram. Multiple crypto news outlets publish coverage the same day.","source":"","source_url":"https://www.theblock.co/post/258064/us-rapper-nellys-x-account-compromised-crypto-phishing-scams"},{"date":"2023-10-18","event":"Scam Sniffer publicly denies affiliation with @NellioETH on X, confirming the account is fraudulent and urging users to use only scamsniffer.io.","source":"","source_url":"https://crypto.news/account-tied-to-rapper-nelly-compromised-used-for-crypto-phishing-scam/"},{"date":"2023-10-18","event":"@NellioETH account is suspended or deleted by X; the profile returns a 'does not exist' message at time of reporting.","source":"","source_url":"https://cryptopotato.com/american-rapper-nellys-x-account-reportedly-hacked-and-involved-in-crypto-phishing-scheme/"},{"date":"2024-08","event":"A separate but related pattern of celebrity account hacks for meme coin pump-and-dump schemes begins, documented by ZachXBT, ultimately accounting for at least $3.5 million in losses across multiple celebrities including Usher and Wiz Khalifa. This campaign is distinct from the 2023 Nelly hack.","source":"","source_url":"https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/","date_original":"2024-08-01"}],"sources_used":[{"url":"http://web.archive.org/web/20240526183657/https://www.theblock.co/post/258064/us-rapper-nellys-x-account-compromised-crypto-phishing-scams","name":"X account tied to rapper Nelly compromised, used for crypto phishing scam — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20240526183657/https://www.theblock.co/post/258064/us-rapper-nellys-x-account-compromised-crypto-phishing-scams","credibility":2,"archive_timestamp":"2024-05-26T18:36:57+00:00"},{"url":"http://web.archive.org/web/20260526034315/https://cryptopotato.com/american-rapper-nellys-x-account-reportedly-hacked-and-involved-in-crypto-phishing-scheme/","name":"American Rapper Nelly's X Account Reportedly Hacked and Involved in Crypto Phishing Scheme — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20260526034315/https://cryptopotato.com/american-rapper-nellys-x-account-reportedly-hacked-and-involved-in-crypto-phishing-scheme/","credibility":2,"archive_timestamp":"2026-05-26T03:43:15+00:00"},{"url":"http://web.archive.org/web/20260525201422/https://crypto.news/account-tied-to-rapper-nelly-compromised-used-for-crypto-phishing-scam/","name":"Account tied to rapper Nelly compromised, used for crypto phishing scam — Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260525201422/https://crypto.news/account-tied-to-rapper-nelly-compromised-used-for-crypto-phishing-scam/","credibility":2,"archive_timestamp":"2026-05-25T20:14:22+00:00"},{"url":"https://www.cryptotimes.io/2023/10/18/rapper-nellys-x-account-got-hacked-used-for-phishing-scam/","name":"Rapper Nelly's X Account Got Hacked, Used For Phishing Scam — The Crypto Times","type":"news_article","archive_url":"https://web.archive.org/web/20260725041137/https://www.cryptotimes.io/2023/10/18/rapper-nellys-x-account-got-hacked-used-for-phishing-scam/","credibility":2,"archive_timestamp":"2026-07-25T04:11:37+00:00"},{"url":"http://web.archive.org/web/20250914182543/https://cryptonews.com/news/popular-rappers-x-profile-hacked-promote-crypto-phishing-site/","name":"Popular Rapper's X Profile Hacked to Promote Crypto Phishing Site — CryptoNews","type":"news_article","archive_url":"http://web.archive.org/web/20250914182543/https://cryptonews.com/news/popular-rappers-x-profile-hacked-promote-crypto-phishing-site/","credibility":2,"archive_timestamp":"2025-09-14T18:25:43+00:00"},{"url":"http://web.archive.org/web/20260526024835/https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/","name":"ZachXBT Connects Social Media Hacks to $3.5M Celebrity Meme Coin Scam — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20260526024835/https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/","credibility":2,"archive_timestamp":"2026-05-26T02:48:35+00:00"},{"url":"http://web.archive.org/web/20250427231434/https://www.theblock.co/post/270105/crypto-phishing-attacks-2023","name":"Crypto phishing attacks drained nearly $300 million in 2023: Scam Sniffer — The Block","type":"research","archive_url":"http://web.archive.org/web/20250427231434/https://www.theblock.co/post/270105/crypto-phishing-attacks-2023","credibility":2,"archive_timestamp":"2025-04-27T23:14:34+00:00"}],"source_tags":["etherscan","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:05:02.682528+00:00","updated_at":"2026-08-29T01:35:41.482+00:00"}}