Verify a decision

{"actor":"system:backfill","investigation_id":"673de303-e10f-4bb5-88e0-2a1080d440c0","kind":"publish","page_slug":"iran-war-panic-crypto-scam-network-oramama-x-account-manipulation","published_at":"2026-06-15T12:29:19.907Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Iran War Panic Crypto Scam Network (ORAMAMA / X Account Manipulation)","sections":[{"content":"On March 23, 2026, blockchain investigator ZachXBT published a multi-part thread on X detailing a coordinated social engineering operation that exploited geopolitical fear narratives — primarily the 2026 Iran war and fabricated reports of hospital blackouts in Cuba — to build large audiences on X and subsequently funnel those audiences into cryptocurrency scams. ZachXBT stated: 'I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.' The investigation identified 11 accounts in the initial cluster, with five additional linked accounts identified later the same day, bringing the total to 16. All 16 accounts were suspended by X by the evening of March 23, 2026. ZachXBT noted that all 11 original accounts blocked him simultaneously after publication, commenting 'almost as if they're operated by one person,' suggesting a single operator or tightly coordinated group behind the entire network.","heading":"Overview and Discovery","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT on X: original thread tweet (1/)","type":"social_media","url":"https://x.com/zachxbt/status/2035989255395082589"},{"credibility":2,"name":"ZachXBT on X: ORAMAMA pump-and-dump tweet (6/)","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"}]},{"content":"ZachXBT published a table of user IDs for 11 accounts in the initial cluster: @BinsaeedRashid, @cn_redoracle, @wanglaurentceo, @bdcryptoguru, @Whale_Guru, @BaronDominus, @ItsAnonApe, @antmillionsbot, @CNBlockIntel, @sungleeiq, and @rami_hashimi. Five additional linked accounts — @jihooncrypto, @seongwooiq300, @iq300min, @raqeem_saudi, and @mrcryptowhalecn — were identified later the same day. The accounts used AI-generated profile pictures to construct fake personas: an AI-generated Asian news persona, a wealthy Sheikh persona, and a Chinese oracle persona. The lead account, @wanglaurentceo, operating under the name 'Wang Laurent,' accumulated approximately 79,900 followers and cycled through 17 different usernames over its lifetime, including 'usdtt11,' 'xrpinsol,' and 'edtrumpofficial.' ZachXBT described this account as an AI-generated fake Asian version of Mario Nawfal — created by running Nawfal's profile photo through an image generation tool. The @BinsaeedRashid account, operating as a 'Sheikh larp,' accumulated over 350,000 followers, changed usernames at least three times in two years, and listed a USA location despite claiming UAE residency. @cn_redoracle operated as a 'Chinese breaking news' account.","heading":"Identified Accounts and AI Persona Tactics","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran news accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"ZachXBT Exposes Fake War News Crypto Scam on X — CryptocurrencyHelp","type":"news_article","url":"https://cryptocurrencyhelp.com/news/zachxbt-exposes-fake-war-news-crypto-scam-x/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"}]},{"content":"The network's operational playbook, as documented by ZachXBT, followed a repeatable four-step sequence. First, the operators purchased aged X accounts with pre-existing follower bases to establish immediate credibility. Second, the accounts posted alarming, emotionally charged content about geopolitical events multiple times per day — described by ZachXBT as 'doomposting' — including fabricated claims of Iranian hit lists targeting civilian infrastructure across Saudi Arabia, the UAE, Qatar, Bahrain, Kuwait, and Jordan, and false reports of a total hospital blackout in Cuba killing ventilator patients (though Cuba did experience genuine power grid instability in March 2026, which Cuban President Diaz-Canel acknowledged publicly on March 20, 2026). Third, accounts within the cluster cross-reposted each other's content to artificially manufacture virality, causing posts to accumulate millions of views and large engagement numbers. Fourth, once an audience was established, the accounts pivoted to promoting fake giveaways or low-cap cryptocurrency tokens before changing usernames to obscure their tracks. ZachXBT noted that large legitimate accounts unknowingly amplified the content through ordinary engagement, further widening the audience.","heading":"Social Engineering Methodology","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Uncovers Coordinated Network Exploiting Political Fear — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/zachxbt-uncovers-coordinated-network-exploiting-political-fear-to-fuel-cryptocurrency-scams/"},{"credibility":2,"name":"ZachXBT Flags Coordinated Crypto Scams Through War Posts on X — Invezz","type":"news_article","url":"https://invezz.com/news/2026/03/23/zachxbt-flags-coordinated-crypto-scams-through-war-posts-on-x/"},{"credibility":2,"name":"US-Iran War Related Panic Is Being Used for Crypto Scams: ZachXBT — CoinGape","type":"news_article","url":"https://coingape.com/us-iran-war-related-panic-is-being-used-for-crypto-scams-zachxbt/"}]},{"content":"On February 22, 2026, ten accounts within the identified cluster simultaneously promoted $ORAMAMA, a meme coin launched on Solana's PumpSwap decentralized exchange. According to ZachXBT's tweet (thread position 6/): 'Ten X accounts in the cluster all promoted the pump and dump crypto scam $ORAMAMA on February 22, 2026 before never posting about it again. Onchain evidence suggests the scheme profited six figures.' After the coordinated promotion, none of the accounts posted about $ORAMAMA again — a pattern consistent with a pump-and-dump where insiders sell into the retail demand generated by the promotion wave. The ORAMAMA token pair address on Solana/PumpSwap is listed on DEX Screener as 3f1Tfjdwxmj44haRowhdqkheKddyxyvahbXdjjPtqQNh. The specific profit figure within the 'six figures' range was not disclosed in ZachXBT's public reporting, and no individual wallet addresses were published. ZachXBT added: 'I suspect they are farming engagement once again for another upcoming scam.'","heading":"$ORAMAMA Token: Pump-and-Dump on Solana","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT on X: ORAMAMA pump-and-dump tweet (6/)","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"news_article","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ORAMAMA / SOL on Solana / PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"}]},{"content":"A notable dimension of ZachXBT's investigation was a public warning about the scalability of this attack model. ZachXBT stated: 'It's scary to think about the implications of it if a nation state actor operated the same scheme rather than a meme coin scammer given how easy it is to operate.' The infrastructure required — purchased aged accounts, AI-generated imagery, and coordinated cross-posting — is inexpensive and widely accessible. ZachXBT also stated: 'Platform manipulation should result in bans and face legal consequences given the propaganda has many X users currently falling for fake news every day.' This framing drew coverage beyond typical crypto-scam reporting, with outlets noting the dual-use nature of the technique as both a financial fraud vector and a potential political disinformation tool.","heading":"Nation-State Threat Vector Warning","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"}]},{"content":"Following the publication of ZachXBT's findings on March 23, 2026, all 11 originally named accounts blocked ZachXBT simultaneously. X (formerly Twitter) subsequently suspended all 16 accounts identified in the full investigation — the original 11 plus five additional linked accounts (@jihooncrypto, @seongwooiq300, @iq300min, @raqeem_saudi, @mrcryptowhalecn) — by the evening of March 23, 2026. No law enforcement action or regulatory filing has been publicly reported in connection with this network as of June 2026. The coordinated and simultaneous nature of the blocking behavior across all 11 accounts, immediately upon publication, was cited by ZachXBT as evidence of centralized control of the network.","heading":"Platform Response and Account Suspensions","severity":"medium","sources":[{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},{"content":"The primary evidentiary basis for this investigation is ZachXBT's March 23, 2026 public thread on X, which included screenshots and a published table of account user IDs. ZachXBT is a well-regarded independent on-chain investigator with a documented track record of accurate scam exposures, but his findings have not been independently verified by a regulatory body, law enforcement agency, or Tier 1 news outlet as of the publication of this page. Secondary reporting comes from a range of Tier 2 crypto news outlets (CoinGape, Coinpedia, CryptoTimes, BeInCrypto, Cryptopolitan, The Daily Hodl, Blockchain.news, CryptoAdventure, Invezz) and does not add primary evidence beyond ZachXBT's thread. No court filings, SEC/CFTC actions, or major financial press coverage (Reuters, Bloomberg, WSJ) have been identified. The six-figure profit claim is attributed to ZachXBT's on-chain analysis; individual wallet addresses and exact dollar amounts have not been made public. Confidence is rated 0.88 reflecting high consistency across multiple secondary sources all tracing to the same credible primary investigator.","heading":"Source Credibility and Evidentiary Basis","severity":"low","sources":[{"credibility":2,"name":"ZachXBT on X: original thread tweet (1/)","type":"social_media","url":"https://x.com/zachxbt/status/2035989255395082589"},{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran news accounts as crypto scammers — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT on X: original thread tweet (1/)","type":"social_media","url":"https://x.com/zachxbt/status/2035989255395082589"},{"credibility":2,"name":"ZachXBT on X: ORAMAMA pump-and-dump tweet (6/)","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"},{"credibility":2,"name":"US-Iran War Related Panic Is Being Used for Crypto Scams: ZachXBT — CoinGape","type":"news_article","url":"https://coingape.com/us-iran-war-related-panic-is-being-used-for-crypto-scams-zachxbt/"},{"credibility":2,"name":"ZachXBT Uncovers Coordinated Network Exploiting Political Fear — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/zachxbt-uncovers-coordinated-network-exploiting-political-fear-to-fuel-cryptocurrency-scams/"},{"credibility":2,"name":"ZachXBT Flags Coordinated Crypto Scams Through War Posts on X — Invezz","type":"news_article","url":"https://invezz.com/news/2026/03/23/zachxbt-flags-coordinated-crypto-scams-through-war-posts-on-x/"},{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran news accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"news_article","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ZachXBT Exposes Fake War News Crypto Scam on X — CryptocurrencyHelp","type":"news_article","url":"https://cryptocurrencyhelp.com/news/zachxbt-exposes-fake-war-news-crypto-scam-x/"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"},{"credibility":2,"name":"ORAMAMA / SOL on Solana / PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scams Exploiting Iran War Narrative — HTX Insights","type":"news_article","url":"https://www.htx.com/news/zachxbt-exposes-crypto-scams-exploiting-iran-war-narrative-t-fJZmcWVC/"}],"summary":"In March 2026, on-chain investigator ZachXBT exposed a coordinated network of at least 11 X accounts that manufactured fake geopolitical panic — primarily around the Iran war and Cuban humanitarian crises — to funnel followers into pump-and-dump cryptocurrency schemes. The network used purchased aged accounts, AI-generated fake personas, and mass cross-reposting to artificially inflate reach, culminating in the coordinated promotion of the $ORAMAMA token on Solana's PumpSwap on February 22, 2026, generating alleged six-figure on-chain profits. X suspended all 16 identified accounts by the evening of March 23, 2026.","timeline":[{"date":"2026-02-22","event":"Ten accounts in the network simultaneously promoted the $ORAMAMA meme coin on Solana PumpSwap in a coordinated push, then ceased all mentions of the token. On-chain evidence indicates six-figure profits were generated.","source":"ZachXBT on X","source_url":"https://x.com/zachxbt/status/2035989271652466773"},{"date":"2026-03-20","event":"Cuban President Diaz-Canel publicly acknowledged real power grid failures in Cuba — the factual kernel that the scam network had been exploiting with fabricated claims of hospital blackouts killing ventilator patients.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"date":"2026-03-23","event":"ZachXBT published a multi-part investigation thread on X identifying 11 accounts, their methodology (purchased aged accounts, doomposting, cross-reposting, scam promotion), the AI-generated @wanglaurentceo persona, and the $ORAMAMA pump-and-dump. He warned of nation-state applicability of the same technique.","source":"ZachXBT on X","source_url":"https://x.com/zachxbt/status/2035989255395082589"},{"date":"2026-03-23","event":"All 11 originally identified accounts simultaneously blocked ZachXBT upon publication of his thread, consistent with centralized operator control.","source":"The Daily Hodl","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"date":"2026-03-23","event":"ZachXBT identified five additional linked accounts: @jihooncrypto, @seongwooiq300, @iq300min, @raqeem_saudi, and @mrcryptowhalecn, bringing the total network count to 16.","source":"The Daily Hodl","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"date":"2026-03-23","event":"X (formerly Twitter) suspended all 16 identified accounts by end of day.","source":"Crypto.news","source_url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},"v":1}