Audit log

Every state-changing event for ORAMAMA X War-Panic Scam Network: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-11 17:05:05Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,507,006

   sig

   4d3bmTHV1ZTJ…9tX1wFPjcopyexplorer ↗

   hash

   bVvFnZppi8hz…B4nNkW2Hcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (15927 B) ▸

   {"actor":"system:backfill","investigation_id":"03c192ed-953c-4829-b6f7-e199e2fd5783","kind":"publish","page_slug":"oramama-x-war-panic-scam-network","published_at":"2026-08-11T17:05:04.328Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ORAMAMA X War-Panic Scam Network","sections":[{"content":"On-chain investigator ZachXBT publicly disclosed a coordinated network of more than 10 accounts on X in March 2026 that operated as a unified engagement-farming and crypto-fraud operation. ZachXBT described the network in his own words: 'I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.' The network's operators purchased pre-existing X accounts with established follower bases rather than growing accounts organically, allowing the cluster to immediately access large audiences. Across the identified cluster, up to 16 accounts were ultimately flagged, with 11 accounts confirmed to have blocked ZachXBT simultaneously after his disclosure — coordinated defensive behavior consistent with centralized control. One documented account within the cluster had changed usernames approximately 17 times and had amassed nearly 80,000 followers, suggesting long-running operation before monetization.","heading":"Network Overview and Structure","severity":"critical","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},{"content":"The network's operators used AI image and content generation tools to fabricate convincing personas layered on top of purchased accounts. One documented example involved an account operating under the handle 'Wang Laurent', which was constructed as an AI-generated Asian-presenting version of prominent news curator Mario Nawfal — including a profile image derived from AI manipulation of Nawfal's likeness. The account changed its username approximately 17 times across its operational lifespan, accumulating close to 80,000 followers. Across the cluster, accounts posted geopolitical 'doompost' content multiple times daily, including alleged claims that Iran had threatened to cut undersea cables responsible for 95–99% of global internet traffic. One such post accumulated approximately 26,000 retweets, 50,000 likes, and 1.8 million views. Accounts within the cluster cross-reposted each other's content systematically to manufacture the appearance of independent viral spread. After building engagement through fear-driven content, accounts pivoted to fake giveaways and direct cryptocurrency promotion, then changed usernames to obscure their histories. This multi-stage playbook — acquire, amplify, monetize, rename — was repeated across the network.","heading":"AI-Generated Personas and Geopolitical Disinformation Methodology","severity":"critical","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},{"content":"On February 22, 2026, all ten identified core accounts in the network simultaneously promoted $ORAMAMA, a meme coin deployed on the Solana blockchain and traded on PumpSwap. ZachXBT stated: 'Ten X accounts in the cluster all promoted the pump and dump crypto scam $ORAMAMA on February 22, 2026 before never posting about it again.' The synchronized promotion — occurring across nominally independent accounts with no prior stated affiliation — is consistent with a coordinated pump-and-dump pattern in which operators hold pre-acquired token positions, drive retail purchase activity through promotional posts, and then sell into the resulting demand spike. After the February 22 promotion, none of the accounts mentioned the token again, which ZachXBT identified as a behavioral marker of deliberate abandonment following profit extraction. The token's pool address on Solana PumpSwap has been independently recorded at 3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh. On-chain data reviewed by ZachXBT confirmed the scheme generated six-figure profits in US dollar terms.","heading":"ORAMAMA Token Pump-and-Dump (February 22, 2026)","severity":"critical","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ORAMAMA / SOL pool on PumpSwap — DEX Screener (on-chain)","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ORAMAMA/SOL — GeckoTerminal (on-chain)","type":"on_chain","url":"https://www.geckoterminal.com/solana/pools/3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"}]},{"content":"ZachXBT explicitly raised the concern that this operational playbook — purchasing aged, follower-rich accounts, layering AI-fabricated personas, flooding timelines with emotionally charged geopolitical disinformation, and then monetizing the accumulated audience — could be adopted at scale by state-level actors. ZachXBT's exact statement, as reported across multiple outlets: 'It's scary to think about the implications of it if a nation-state actor operated the same scheme rather than a meme coin scammer, given how easy it is to operate.' The network's documented ability to generate 1.8 million views on a single false post — about Iran threatening global internet infrastructure — illustrates how disinformation content can be made viral at low cost and high speed, independent of any crypto monetization motive. Security researchers and crypto journalists covering the story noted that the combination of AI-generated content, purchased account histories, and coordinated cross-amplification represents a scalable influence operation template.","heading":"Nation-State Disinformation Risk Assessment","severity":"high","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},{"content":"Following ZachXBT's public disclosure of the network in late March 2026, all 11 core accounts blocked ZachXBT simultaneously — a coordinated response consistent with centralized operator control monitoring the investigator's activity. X subsequently suspended all 16 flagged accounts that ZachXBT identified. ZachXBT stated: 'I believe platform manipulation should result in bans and face legal consequences given the propaganda has many X users currently falling for fake news every day.' X's product leadership referenced enhanced anti-bot detection and AI-content flagging measures in response to coverage of the incident, though no formal platform statement specifically addressing this network has been publicly documented. No law enforcement action or regulatory referral has been publicly confirmed as of the time of writing.","heading":"Platform Response and Account Suspension","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},{"content":"The primary source for all documented findings is ZachXBT, a pseudonymous on-chain investigator with a documented track record of accurate crypto fraud investigations, including cases subsequently confirmed by law enforcement or regulatory bodies. ZachXBT's findings in this case are supported by on-chain evidence (confirmed $ORAMAMA pool data on PumpSwap), behavioral evidence (simultaneous blocking, coordinated posting timestamps), and open-source content analysis (archived X posts, engagement metrics). No independent law enforcement or regulatory body has issued a public statement corroborating or contradicting ZachXBT's findings as of the investigation date. The six-figure profit claim is attributed to ZachXBT's on-chain analysis; the specific USD amount has not been independently disclosed in available public sources. All claims regarding operator identity, account acquisition methods, and AI tooling used remain unattributed to named individuals and should be treated as alleged pending further investigation.","heading":"Investigator Attribution and Source Credibility","severity":"low","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"Fake X Influencers Used AI and War Content to Drive Six-Figure Crypto Scam Profits — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/fake-x-influencers-used-ai-to-drive-crypto-scam/"}]}],"sources_used":[{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"Fake X Influencers Used AI and War Content to Drive Six-Figure Crypto Scam Profits — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/fake-x-influencers-used-ai-to-drive-crypto-scam/"},{"credibility":2,"name":"ORAMAMA / SOL pool on PumpSwap — DEX Screener (on-chain)","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ORAMAMA/SOL — GeckoTerminal (on-chain)","type":"on_chain","url":"https://www.geckoterminal.com/solana/pools/3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh"},{"credibility":3,"name":"ZachXBT Exposes X Network Using War Panic to Push Crypto Scams — Crypto2Community","type":"news_article","url":"https://crypto2community.com/crypto-news/zachxbt-exposes-x-network-using-war-panic-to-push-crypto-scams/"}],"summary":"The ORAMAMA X War-Panic Scam Network is a coordinated cluster of more than 10 accounts on X (formerly Twitter) that used AI-generated geopolitical fear content — including fabricated claims about the US-Iran conflict — to accumulate large audiences before executing a confirmed pump-and-dump of the Solana meme token $ORAMAMA on February 22, 2026. On-chain investigator ZachXBT exposed the network in March 2026, documenting six-figure profits and warning that the scalable playbook posed nation-state-level disinformation risks.","timeline":[{"date":"2026-02-22","event":"All ten core accounts in the network simultaneously promoted $ORAMAMA, a Solana meme coin on PumpSwap, in a coordinated pump-and-dump. Accounts never mentioned the token again after this date.","source":"CryptoTimes / ZachXBT investigation","source_url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"date":"2026-03-23","event":"ZachXBT publicly disclosed the coordinated network on X, publishing findings identifying 10+ accounts, the AI persona methodology, the ORAMAMA pump-and-dump, and six-figure on-chain profits. Multiple crypto news outlets covered the disclosure the same day.","source":"Crypto.news / CryptoTimes / CoinEdition","source_url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"},{"date":"2026-03-23","event":"All 11 identified core accounts blocked ZachXBT simultaneously following his public disclosure, indicating centralized coordination among the network operators.","source":"The Daily Hodl / CoinEdition","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"},{"date":"2026-03-26","event":"X suspended all 16 scam accounts flagged by ZachXBT following his investigation thread.","source":"The Daily Hodl","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 85828eca-e6bd-480c-a2a1-66e1833366c7copy
2. #2reviewby reviewerreviewer

   2026-08-25 19:46:01Z
   Score: 2 → 2 (no score change)
   The page's core claims — network size, the ORAMAMA pump-and-dump mechanics, the AI-persona methodology, the nation-state warning, and the platform response — are well corroborated across multiple independent secondary outlets reporting on a single underlying ZachXBT disclosure, and specific figures (follower counts, username-change counts, engagement metrics, pool address) were independently verified rather than merely superficially matched. The 'coordinated network' framing reflects ZachXBT's own stated conclusion, not the page's own invention. Weaknesses found are narrow: one unattributed 'security researchers say' framing lacks a specific source, and one claim about X's 'product leadership' response overstates a source's generic background context as a direct reaction to this case; no claim was found to be disputed by a more credible contrary source, and all cited URLs resolved and supported their claims (no link rot detected).
   anchoranchored

   chain

   ●mainnet-betaslot 443,516,971

   sig

   3nNtGouVp2j8…97z4DQ81copyexplorer ↗

   hash

   CEtTyxNij15D…Uwk63Li5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1310 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T19:46:01.051Z","decision":"review","investigation_id":"03c192ed-953c-4829-b6f7-e199e2fd5783","new_score":2,"page_slug":"oramama-x-war-panic-scam-network","prev_score":2,"reason":"The page's core claims — network size, the ORAMAMA pump-and-dump mechanics, the AI-persona methodology, the nation-state warning, and the platform response — are well corroborated across multiple independent secondary outlets reporting on a single underlying ZachXBT disclosure, and specific figures (follower counts, username-change counts, engagement metrics, pool address) were independently verified rather than merely superficially matched. The 'coordinated network' framing reflects ZachXBT's own stated conclusion, not the page's own invention. Weaknesses found are narrow: one unattributed 'security researchers say' framing lacks a specific source, and one claim about X's 'product leadership' response overstates a source's generic background context as a direct reaction to this case; no claim was found to be disputed by a more credible contrary source, and all cited URLs resolved and supported their claims (no link rot detected).","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bea91a2c-c306-4449-b132-df267fde22e5copy
3. #3review approveby judgejudge

   2026-08-25 19:46:01Z
   Score: 2 → 2 (no score change)
   Of 24 claims checked, 20 were independently confirmed, 3 were partially supported, 1 was unverifiable, and none were disputed, putting the disputed-plus-unverifiable rate at about 4% — well inside the approval range. Core facts (the size and mechanics of the account network, the Feb 22, 2026 $ORAMAMA promotion and abandonment pattern, the on-chain PumpSwap pool address, exact engagement figures, and verbatim ZachXBT quotes) were each corroborated across multiple independent outlets or on-chain data (claim_findings[0], [9]-[11], [21]). The 'coordinated network' framing was found to reflect ZachXBT's own stated conclusion rather than the page's own characterization (claim_findings[3]). The weaker points are narrow and non-central: an overly specific description of how the 'Wang Laurent' profile photo was produced (claim_findings[6]), an editorial four-step label for the account playbook that isn't a direct quote from any source (claim_findings[8]), an unattributed 'security researchers say' framing that no cited article actually supports (claim_findings[13]), and a claim that X's 'product leadership' responded to this specific case when the underlying source only offers generic background about platform policy (claim_findings[15]) — the last of these is also self-hedged in the same sentence. No citations showed link rot or staleness, and no coverage gap was flagged high priority, so none of these push the page out of the approve range.
   anchoranchored

   chain

   ●mainnet-betaslot 443,516,984

   sig

   67H9vNAptAzS…wL9RV5ygcopyexplorer ↗

   hash

   F4PeTQuqR7dd…EQFYxtJGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1828 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T19:46:01.051Z","decision":"review_approve","investigation_id":"03c192ed-953c-4829-b6f7-e199e2fd5783","new_score":2,"page_slug":"oramama-x-war-panic-scam-network","prev_score":2,"reason":"Of 24 claims checked, 20 were independently confirmed, 3 were partially supported, 1 was unverifiable, and none were disputed, putting the disputed-plus-unverifiable rate at about 4% — well inside the approval range. Core facts (the size and mechanics of the account network, the Feb 22, 2026 $ORAMAMA promotion and abandonment pattern, the on-chain PumpSwap pool address, exact engagement figures, and verbatim ZachXBT quotes) were each corroborated across multiple independent outlets or on-chain data (claim_findings[0], [9]-[11], [21]). The 'coordinated network' framing was found to reflect ZachXBT's own stated conclusion rather than the page's own characterization (claim_findings[3]). The weaker points are narrow and non-central: an overly specific description of how the 'Wang Laurent' profile photo was produced (claim_findings[6]), an editorial four-step label for the account playbook that isn't a direct quote from any source (claim_findings[8]), an unattributed 'security researchers say' framing that no cited article actually supports (claim_findings[13]), and a claim that X's 'product leadership' responded to this specific case when the underlying source only offers generic background about platform policy (claim_findings[15]) — the last of these is also self-hedged in the same sentence. No citations showed link rot or staleness, and no coverage gap was flagged high priority, so none of these push the page out of the approve range.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 76120b58-7145-4c5e-948e-0e9d6c5e2d11copy