{"investigation":{"slug":"wiz-khalifa-pump-fun","entity_name":"Wiz Khalifa Pump Fun","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"On November 3, 2024, unidentified scammers compromised the X (Twitter) account of rapper Wiz Khalifa (35.7 million followers) and used it to promote two fraudulent Solana meme coins — $WIZ and $WIZZLE — launched on pump.fun. The $WIZ token reached a peak market cap of approximately $2.5 million within 15 minutes before collapsing over 95% in under one hour, with at least two insider wallets extracting a combined $160,000 in profit. Blockchain investigator ZachXBT linked the incident to a broader campaign of celebrity account takeovers that allegedly stole over $3.5 million in total, and subsequently accused a former professional Fortnite player known as 'Serpent' of involvement in the coordinated scheme.","sections":[{"content":"Two Solana-based meme coins, $WIZ and $WIZZLE, were deployed on pump.fun on or around November 3, 2024, following the compromise of Wiz Khalifa's X account. Pump.fun is a Solana-based launchpad that permits permissionless token creation in seconds with no coding required, making it a frequent vector for hit-and-run scams. The hacker, impersonating Wiz Khalifa, posted that he had been 'working with my team to drop $WIZ for all the crypto fam' and shared a direct pump.fun link. The post was deleted after the scam completed. Wiz Khalifa's verified X account has approximately 35.7 million followers, providing the attacker with a high-visibility distribution channel. Neither $WIZ nor $WIZZLE was officially endorsed by or affiliated with Cameron Jibril Thomaz (Wiz Khalifa).","heading":"Token Overview and Launch Mechanics","sources":[],"severity":"medium"},{"content":"The $WIZ token surged approximately 2,000% in price within the first 15 minutes of launch, reaching a peak market cap of over $2.5 million. Within one hour, the market cap had collapsed to under $28,000 — a decline of over 95%. At the time of initial reporting (November 4, 2024), the token's market cap had fallen further to approximately $7,900. On-chain data identified at least two wallets that purchased approximately 155 million WIZ tokens for a combined entry cost of $19,100 shortly after launch and subsequently sold for a combined profit of approximately $160,000. The Quadriga Initiative's fraud repository records the total amount lost in the incident as approximately $119,000 USD, extracted by the attacker within roughly six minutes through pre-positioned 'sniping' of the token at launch. Investors who purchased based on the fraudulent celebrity post suffered near-total losses.","heading":"Price Action and Investor Losses","sources":[],"severity":"medium"},{"content":"Blockchain investigator ZachXBT posted a public warning on November 3–4, 2024, stating: 'Do not buy the Wiz Khalifa pump fun [token] it's the same hacker who compromised Andy Ayrey.' ZachXBT subsequently published a broader investigation (November 26–27, 2024) identifying the Wiz Khalifa account compromise as the final incident in a series of at least nine related account takeovers conducted between August and November 2024. The investigation alleged that proceeds from each pump-and-dump operation were recycled — 'funds made from one operation used to deploy and snipe another fake meme coin' — creating a financially self-sustaining scam network. ZachXBT traced the connections through direct funding flows between associated wallet addresses and shared crypto casino deposit addresses on platforms including Roobet, Stake, and BC Game. The total alleged theft across the full campaign was estimated at $3.5 million via 16 tokens on pump.fun. ZachXBT's November 27 thread alleged that a former Australian professional Fortnite player known by the handle 'Serpent' was involved. Serpent had previously presented himself as a blockchain security analyst and founder of a threat mitigation system called Sentinel, and had been expelled from esports organization Overtime in 2020 for alleged cheating. ZachXBT alleged that Serpent's wallet addresses were directly connected to the scam operations and that Serpent deleted his X account posts after Part 1 of the investigation was published. No law enforcement action or criminal charges have been publicly confirmed as of the writing of this report. All attribution to Serpent remains alleged.","heading":"ZachXBT Investigation and Attribution","sources":[],"severity":"medium"},{"content":"The Wiz Khalifa incident was the last in an alleged series of account takeovers beginning in August 2024. Other accounts allegedly compromised in the same campaign include: McDonald's Instagram (token: GRIMACE, ~$690,000 extracted); musician Usher's account (token: USHER, approximately $650,000 / 4,868 SOL); Truth Terminal creator Andy Ayrey's account (multiple tokens including TRUTH and INFINITY, over $2.1 million across six tokens, including a $750,000 deposit to a casino address); actor Dean Norris; the owner of Kabosu (the Shiba Inu dog that inspired the Dogecoin meme); and Enoshima Aquarium in Japan. Additional tokens promoted across the campaign included GRIMACE, SCHRADER, RNA, WOAH, and KAI. ZachXBT noted a further alleged rug pull involving a project called ERROR, alleged to be Serpent's own cryptocurrency project and connected to wallet addresses tied to the compromised accounts.","heading":"Broader Campaign: Related Celebrity Account Hacks","sources":[],"severity":"medium"},{"content":"Pump.fun is a Solana-based permissionless token launchpad that allows any user to deploy a meme coin in seconds without coding knowledge. While the platform is widely used for legitimate meme coin launches, its near-zero barrier to entry makes it a preferred tool for hit-and-run pump-and-dump operations. The bonding curve mechanism built into pump.fun rewards early buyers who sell quickly, which structurally rewards insiders who pre-position before a promotional post goes live. The Wiz Khalifa incident is one of multiple high-profile scams associated with pump.fun-based ATO campaigns. Pump.fun itself was not alleged to be complicit in or aware of the specific fraud.","heading":"Platform Context: Pump.fun","sources":[],"severity":"medium"}],"timeline":[{"date":"2024-08","event":"ZachXBT's investigation indicates the ATO campaign allegedly linked to Serpent began in approximately August 2024 with the first compromised social media accounts promoting pump.fun tokens.","source":"","source_url":"https://protos.com/hacked-x-and-insta-accounts-used-for-pump-fun-rug-pulls/","date_original":"2024-08-01"},{"date":"2024-08","event":"McDonald's Instagram account compromised; GRIMACE token launched on pump.fun, allegedly extracting approximately $690,000.","source":"","source_url":"https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/","date_original":"2024-08-01"},{"date":"2024-10-29","event":"Truth Terminal creator Andy Ayrey's X account compromised; multiple tokens including TRUTH and INFINITY launched, with over $2.1 million allegedly stolen.","source":"","source_url":"https://crypto.news/crypto-scammers-hack-wiz-khalifas-account-to-promote-fake-wiz-meme-coin/"},{"date":"2024-11-03","event":"Wiz Khalifa's X account compromised. Fraudulent posts promoting $WIZ and $WIZZLE tokens on pump.fun published. $WIZ peaks at ~$2.5 million market cap within 15 minutes.","source":"","source_url":"https://crypto.news/crypto-scammers-hack-wiz-khalifas-account-to-promote-fake-wiz-meme-coin/"},{"date":"2024-11-03","event":"ZachXBT posts public warning: 'Do not buy the Wiz Khalifa pump fun [token] it's the same hacker who compromised Andy Ayrey.' Fraudulent posts deleted from Wiz Khalifa's account.","source":"","source_url":"https://x.com/zachxbt/status/1861450263925559399"},{"date":"2024-11-04","event":"$WIZ market cap collapses from $2.5 million to approximately $7,900. At least two insider wallets extract a combined $160,000. Approximate investor losses recorded at $119,000 USD.","source":"","source_url":"https://cryptonews.com/news/scammers-hack-rapper-wiz-khalifas-x-account-to-promote-fake-wiz-meme-coin/"},{"date":"2024-11-26","event":"ZachXBT publishes Part 1 of broader investigation linking nine or more account takeovers across McDonald's, Usher, Wiz Khalifa, Andy Ayrey, Dean Norris, and others to a single alleged threat actor. Total estimated theft: $3.5 million via 16 pump.fun tokens.","source":"","source_url":"https://x.com/zachxbt/status/1861450263925559399"},{"date":"2024-11-27","event":"ZachXBT publishes Part 2 alleging that a former professional Fortnite player known as 'Serpent', an Australian previously expelled from esports org Overtime for cheating, was involved. Serpent allegedly deletes X posts after Part 1 is published. Gambling platform deposits on Roobet, Stake, and BC Game allegedly linked to scam wallet addresses.","source":"","source_url":"https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/"}],"sources_used":[{"url":"https://crypto.news/crypto-scammers-hack-wiz-khalifas-account-to-promote-fake-wiz-meme-coin/","name":"Crypto scammers hack Wiz Khalifa's account to promote fake WIZ meme coin","type":"news_article","archive_url":"http://web.archive.org/web/20260525201445/https://crypto.news/crypto-scammers-hack-wiz-khalifas-account-to-promote-fake-wiz-meme-coin/","credibility":2,"archive_timestamp":"2026-05-25T20:14:45+00:00"},{"url":"http://web.archive.org/web/20250326163237/https://x.com/zachxbt/status/1861450263925559399","name":"ZachXBT on X: Over the past few months I have been tracking a series of related compromises","type":"social_media","archive_url":"http://web.archive.org/web/20250326163237/https://x.com/zachxbt/status/1861450263925559399","credibility":2,"archive_timestamp":"2025-03-26T16:32:37+00:00"},{"url":"http://web.archive.org/web/20250814055826/https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/","name":"ZachXBT Connects Social Media Hacks to $3.5M Celebrity Meme Coin Scam — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20250814055826/https://cryptopotato.com/zachxbt-connects-social-media-hacks-to-3-5m-celebrity-meme-coin-scam/","credibility":2,"archive_timestamp":"2025-08-14T05:58:26+00:00"},{"url":"http://web.archive.org/web/20260123200159/https://protos.com/hacked-x-and-insta-accounts-used-for-pump-fun-rug-pulls/","name":"Hacked X and Insta accounts used for Pump Fun rug pulls — Protos","type":"news_article","archive_url":"http://web.archive.org/web/20260123200159/https://protos.com/hacked-x-and-insta-accounts-used-for-pump-fun-rug-pulls/","credibility":2,"archive_timestamp":"2026-01-23T20:01:59+00:00"},{"url":"http://web.archive.org/web/20250814144024/https://cryptonews.com/news/scammers-hack-rapper-wiz-khalifas-x-account-to-promote-fake-wiz-meme-coin/","name":"Scammers Hack Rapper Wiz Khalifa's X Account to Promote Fake Wiz Meme Coin — CryptoNews","type":"news_article","archive_url":"https://web.archive.org/web/20260526024851/https://cryptonews.com/news/scammers-hack-rapper-wiz-khalifas-x-account-to-promote-fake-wiz-meme-coin/","credibility":2,"archive_timestamp":"2026-05-26T02:48:51+00:00"},{"url":"http://web.archive.org/web/20250409210040/https://cointelegraph.com/news/zachxbt-investigation-alleges-pro-fortnite-player-turned-to-memecoin-scamming","name":"ZachXBT alleges former pro-Fortnite player helped steal $3.5M via memecoin scams — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20250409210040/https://cointelegraph.com/news/zachxbt-investigation-alleges-pro-fortnite-player-turned-to-memecoin-scamming","credibility":2,"archive_timestamp":"2025-04-09T21:00:40+00:00"},{"url":"http://web.archive.org/web/20250411144547/https://defi-planet.com/2024/11/zachxbt-accuses-former-fortnite-pro-serpent-of-involvement-in-3-5m-memecoin-scams/","name":"ZachXBT Accuses Former Fortnite Pro Serpent of Involvement in $3.5M Memecoin Scams — DeFi Planet","type":"news_article","archive_url":"http://web.archive.org/web/20250411144547/https://defi-planet.com/2024/11/zachxbt-accuses-former-fortnite-pro-serpent-of-involvement-in-3-5m-memecoin-scams/","credibility":2,"archive_timestamp":"2025-04-11T14:45:47+00:00"},{"url":"http://web.archive.org/web/20250619091008/https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Wiz_Khalifa_Twitter/X_Account_$WIZ_Token_Launch","name":"Wiz Khalifa Twitter/X Account $WIZ Token Launch — Quadriga Initiative Fraud Repository","type":"community_report","archive_url":"http://web.archive.org/web/20250619091008/https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Wiz_Khalifa_Twitter/X_Account_$WIZ_Token_Launch","credibility":2,"archive_timestamp":"2025-06-19T09:10:08+00:00"},{"url":"http://web.archive.org/web/20250621153035/https://www.coinspeaker.com/wiz-khalifa-x-account-hacked-promote-scam-meme-coin/","name":"Wiz Khalifa's X Account Hacked to Promote Scam Meme Coin — Coinspeaker","type":"news_article","archive_url":"http://web.archive.org/web/20250621153035/https://www.coinspeaker.com/wiz-khalifa-x-account-hacked-promote-scam-meme-coin/","credibility":2,"archive_timestamp":"2025-06-21T15:30:35+00:00"},{"url":"http://web.archive.org/web/20260109122421/https://www.coindesk.com/business/2025/02/11/crypto-investors-lost-over-usd500m-in-memecoin-rug-pulls-and-scams-in-2024","name":"Crypto Investors Lost Over $500M in Memecoin Rug Pulls and Scams in 2024 — CoinDesk","type":"research","archive_url":"http://web.archive.org/web/20260109122421/https://www.coindesk.com/business/2025/02/11/crypto-investors-lost-over-usd500m-in-memecoin-rug-pulls-and-scams-in-2024","credibility":1,"archive_timestamp":"2026-01-09T12:24:21+00:00"}],"source_tags":["etherscan","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:05:01.142564+00:00","updated_at":"2026-08-29T01:35:59.101+00:00"}}