Audit log

Every state-changing event for ORAMAMA X War-Panic Scam Network: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-11 17:05:05Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   bVvFnZppi8hz…B4nNkW2Hcopysha256 → base58

   verifying row…

   canonical bytes (15927 B) ▸

   {"actor":"system:backfill","investigation_id":"03c192ed-953c-4829-b6f7-e199e2fd5783","kind":"publish","page_slug":"oramama-x-war-panic-scam-network","published_at":"2026-08-11T17:05:04.328Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ORAMAMA X War-Panic Scam Network","sections":[{"content":"On-chain investigator ZachXBT publicly disclosed a coordinated network of more than 10 accounts on X in March 2026 that operated as a unified engagement-farming and crypto-fraud operation. ZachXBT described the network in his own words: 'I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.' The network's operators purchased pre-existing X accounts with established follower bases rather than growing accounts organically, allowing the cluster to immediately access large audiences. Across the identified cluster, up to 16 accounts were ultimately flagged, with 11 accounts confirmed to have blocked ZachXBT simultaneously after his disclosure — coordinated defensive behavior consistent with centralized control. One documented account within the cluster had changed usernames approximately 17 times and had amassed nearly 80,000 followers, suggesting long-running operation before monetization.","heading":"Network Overview and Structure","severity":"critical","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},{"content":"The network's operators used AI image and content generation tools to fabricate convincing personas layered on top of purchased accounts. One documented example involved an account operating under the handle 'Wang Laurent', which was constructed as an AI-generated Asian-presenting version of prominent news curator Mario Nawfal — including a profile image derived from AI manipulation of Nawfal's likeness. The account changed its username approximately 17 times across its operational lifespan, accumulating close to 80,000 followers. Across the cluster, accounts posted geopolitical 'doompost' content multiple times daily, including alleged claims that Iran had threatened to cut undersea cables responsible for 95–99% of global internet traffic. One such post accumulated approximately 26,000 retweets, 50,000 likes, and 1.8 million views. Accounts within the cluster cross-reposted each other's content systematically to manufacture the appearance of independent viral spread. After building engagement through fear-driven content, accounts pivoted to fake giveaways and direct cryptocurrency promotion, then changed usernames to obscure their histories. This multi-stage playbook — acquire, amplify, monetize, rename — was repeated across the network.","heading":"AI-Generated Personas and Geopolitical Disinformation Methodology","severity":"critical","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},{"content":"On February 22, 2026, all ten identified core accounts in the network simultaneously promoted $ORAMAMA, a meme coin deployed on the Solana blockchain and traded on PumpSwap. ZachXBT stated: 'Ten X accounts in the cluster all promoted the pump and dump crypto scam $ORAMAMA on February 22, 2026 before never posting about it again.' The synchronized promotion — occurring across nominally independent accounts with no prior stated affiliation — is consistent with a coordinated pump-and-dump pattern in which operators hold pre-acquired token positions, drive retail purchase activity through promotional posts, and then sell into the resulting demand spike. After the February 22 promotion, none of the accounts mentioned the token again, which ZachXBT identified as a behavioral marker of deliberate abandonment following profit extraction. The token's pool address on Solana PumpSwap has been independently recorded at 3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh. On-chain data reviewed by ZachXBT confirmed the scheme generated six-figure profits in US dollar terms.","heading":"ORAMAMA Token Pump-and-Dump (February 22, 2026)","severity":"critical","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ORAMAMA / SOL pool on PumpSwap — DEX Screener (on-chain)","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ORAMAMA/SOL — GeckoTerminal (on-chain)","type":"on_chain","url":"https://www.geckoterminal.com/solana/pools/3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"}]},{"content":"ZachXBT explicitly raised the concern that this operational playbook — purchasing aged, follower-rich accounts, layering AI-fabricated personas, flooding timelines with emotionally charged geopolitical disinformation, and then monetizing the accumulated audience — could be adopted at scale by state-level actors. ZachXBT's exact statement, as reported across multiple outlets: 'It's scary to think about the implications of it if a nation-state actor operated the same scheme rather than a meme coin scammer, given how easy it is to operate.' The network's documented ability to generate 1.8 million views on a single false post — about Iran threatening global internet infrastructure — illustrates how disinformation content can be made viral at low cost and high speed, independent of any crypto monetization motive. Security researchers and crypto journalists covering the story noted that the combination of AI-generated content, purchased account histories, and coordinated cross-amplification represents a scalable influence operation template.","heading":"Nation-State Disinformation Risk Assessment","severity":"high","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},{"content":"Following ZachXBT's public disclosure of the network in late March 2026, all 11 core accounts blocked ZachXBT simultaneously — a coordinated response consistent with centralized operator control monitoring the investigator's activity. X subsequently suspended all 16 flagged accounts that ZachXBT identified. ZachXBT stated: 'I believe platform manipulation should result in bans and face legal consequences given the propaganda has many X users currently falling for fake news every day.' X's product leadership referenced enhanced anti-bot detection and AI-content flagging measures in response to coverage of the incident, though no formal platform statement specifically addressing this network has been publicly documented. No law enforcement action or regulatory referral has been publicly confirmed as of the time of writing.","heading":"Platform Response and Account Suspension","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},{"content":"The primary source for all documented findings is ZachXBT, a pseudonymous on-chain investigator with a documented track record of accurate crypto fraud investigations, including cases subsequently confirmed by law enforcement or regulatory bodies. ZachXBT's findings in this case are supported by on-chain evidence (confirmed $ORAMAMA pool data on PumpSwap), behavioral evidence (simultaneous blocking, coordinated posting timestamps), and open-source content analysis (archived X posts, engagement metrics). No independent law enforcement or regulatory body has issued a public statement corroborating or contradicting ZachXBT's findings as of the investigation date. The six-figure profit claim is attributed to ZachXBT's on-chain analysis; the specific USD amount has not been independently disclosed in available public sources. All claims regarding operator identity, account acquisition methods, and AI tooling used remain unattributed to named individuals and should be treated as alleged pending further investigation.","heading":"Investigator Attribution and Source Credibility","severity":"low","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"Fake X Influencers Used AI and War Content to Drive Six-Figure Crypto Scam Profits — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/fake-x-influencers-used-ai-to-drive-crypto-scam/"}]}],"sources_used":[{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"Fake X Influencers Used AI and War Content to Drive Six-Figure Crypto Scam Profits — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/fake-x-influencers-used-ai-to-drive-crypto-scam/"},{"credibility":2,"name":"ORAMAMA / SOL pool on PumpSwap — DEX Screener (on-chain)","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ORAMAMA/SOL — GeckoTerminal (on-chain)","type":"on_chain","url":"https://www.geckoterminal.com/solana/pools/3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh"},{"credibility":3,"name":"ZachXBT Exposes X Network Using War Panic to Push Crypto Scams — Crypto2Community","type":"news_article","url":"https://crypto2community.com/crypto-news/zachxbt-exposes-x-network-using-war-panic-to-push-crypto-scams/"}],"summary":"The ORAMAMA X War-Panic Scam Network is a coordinated cluster of more than 10 accounts on X (formerly Twitter) that used AI-generated geopolitical fear content — including fabricated claims about the US-Iran conflict — to accumulate large audiences before executing a confirmed pump-and-dump of the Solana meme token $ORAMAMA on February 22, 2026. On-chain investigator ZachXBT exposed the network in March 2026, documenting six-figure profits and warning that the scalable playbook posed nation-state-level disinformation risks.","timeline":[{"date":"2026-02-22","event":"All ten core accounts in the network simultaneously promoted $ORAMAMA, a Solana meme coin on PumpSwap, in a coordinated pump-and-dump. Accounts never mentioned the token again after this date.","source":"CryptoTimes / ZachXBT investigation","source_url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"date":"2026-03-23","event":"ZachXBT publicly disclosed the coordinated network on X, publishing findings identifying 10+ accounts, the AI persona methodology, the ORAMAMA pump-and-dump, and six-figure on-chain profits. Multiple crypto news outlets covered the disclosure the same day.","source":"Crypto.news / CryptoTimes / CoinEdition","source_url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"},{"date":"2026-03-23","event":"All 11 identified core accounts blocked ZachXBT simultaneously following his public disclosure, indicating centralized coordination among the network operators.","source":"The Daily Hodl / CoinEdition","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"},{"date":"2026-03-26","event":"X suspended all 16 scam accounts flagged by ZachXBT following his investigation thread.","source":"The Daily Hodl","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 85828eca-e6bd-480c-a2a1-66e1833366c7copy