Verify a decision

{"actor":"system:backfill","investigation_id":"9cbb3911-3cfc-4e09-be09-ac868908e4e7","kind":"publish","page_slug":"oramama-token-oramama","published_at":"2026-09-18T23:31:29.726Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ORAMAMA Token ($ORAMAMA)","sections":[{"content":"On February 22, 2026, ten coordinated accounts on X (formerly Twitter) simultaneously promoted $ORAMAMA, a meme coin deployed on Solana and traded via PumpSwap. According to ZachXBT's on-chain analysis, published on March 23, 2026, the operators of these accounts had accumulated audiences by posting fabricated and exaggerated geopolitical content — primarily panic narratives tied to US-Iran military tensions — before pivoting abruptly to token promotion. After the pump, none of the accounts ever referenced $ORAMAMA again, a behavioral pattern consistent with a deliberate pump-and-dump exit. On-chain evidence cited by ZachXBT indicated the scheme generated six-figure profits in USD, though an exact figure was not disclosed.","heading":"Scheme Overview","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT on X — original thread, post 6 of the investigation","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"news_article","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ORAMAMA / SOL on Solana / PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"}]},{"content":"ZachXBT's investigation alleged that the 16-account network used a two-phase strategy. In the first phase, operators purchased existing X accounts that already had established follower bases, then used AI-generated content and fabricated personas to post high-volume panic narratives multiple times per day. Examples of fabricated content included claims that Iran had published strike lists targeting civilian infrastructure, and posts alleging Iranian threats to sever undersea cables carrying the majority of global internet traffic. One such post reportedly accumulated 26,000 retweets, 50,000 likes, and 1.8 million views before X's Community Notes flagged the claim as false. ZachXBT noted that numerous legitimate high-profile accounts had unintentionally amplified this content through comments and shares. One identified account allegedly impersonated an AI-generated persona described as an Asian version of commentator Mario Nawfal; this was a fabricated persona, not an actual compromise of Nawfal's account.","heading":"Audience-Building Tactics: AI-Assisted Geopolitical Fear Content","severity":"high","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — Finance Feeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Social Media Network Using Fake News to Promote Crypto Scams — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-exposes-social-media-network-using-fake-news-to-promote-crypto-scams"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — Coin Edition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic To Fuel Pump-and-Dump Crypto Scams — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"}]},{"content":"$ORAMAMA is a Solana-based token traded on PumpSwap, identifiable on DEX Screener at the pool address 3f1TfjDWXMJ44hARowHDQkhEKDdYXYVahbXDjjpTQQnH. ZachXBT's analysis identified on-chain transaction patterns consistent with coordinated accumulation followed by a rapid exit at peak price, yielding six-figure USD profits for the operators. The token's trading history showed a sharp price spike coinciding with the coordinated February 22, 2026 promotional push, followed by a collapse consistent with insider dumping. No legitimate project team, whitepaper, utility, or development activity has been identified for $ORAMAMA. The token appears to have been created solely as a vehicle for the scheme.","heading":"On-Chain Evidence and Token Details","severity":"critical","sources":[{"credibility":2,"name":"ORAMAMA / SOL on Solana / PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam — Blockchain.news","type":"on_chain","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ZachXBT on X — original thread post 6","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"}]},{"content":"Following ZachXBT's public disclosure on March 23, 2026, X (formerly Twitter) suspended all 16 accounts identified in the investigation. ZachXBT noted that the accounts had blocked him shortly after his thread was published, which he interpreted as awareness of the exposure, and that X subsequently took enforcement action. No regulatory body has opened a formal investigation into the $ORAMAMA scheme as of the date of this report, and no criminal charges have been filed. The operators of the accounts have not been publicly identified by name.","heading":"Platform Response: X Account Suspensions","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Uncovers 10+ X Accounts Driving 6-Figure Crypto Scams With AI Tactics — Castle Crypto","type":"news_article","url":"https://castlecrypto.gg/news/zachxbt-uncovers-10-x-accounts-driving-6-figure-crypto-scams-with-ai-tactics/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"}]},{"content":"ZachXBT and several security researchers characterized the $ORAMAMA scheme as a new and replicable threat pattern. The combination of purchased accounts with pre-existing audiences, AI-generated personas, high-volume fabricated geopolitical content, and coordinated token promotion represents an evolution beyond earlier pump-and-dump tactics that relied on direct follower solicitation or paid influencer promotion. ZachXBT stated: 'It's scary to think about the implications of it if a nation-state actor operated the same scheme rather than a meme coin scammer, given how easy it is to operate.' Researchers at multiple outlets noted that the scheme exploited a period of genuine geopolitical tension, making the fabricated panic content harder for ordinary users to distinguish from real news events. The scheme also demonstrated that platform fact-checking mechanisms such as Community Notes are insufficient to prevent viral spread before corrections are applied.","heading":"Novel Threat Pattern: AI-Assisted Geopolitical Audience Farming","severity":"high","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X — Finance Feeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — MEXC News","type":"news_article","url":"https://www.mexc.com/news/975803"},{"credibility":2,"name":"ZachXBT: X Networks Use Fake War News for Crypto Scams — CryptoNewsZ","type":"news_article","url":"https://www.cryptonewsz.com/zachxbt-networks-fake-war-news-crypto-scams/"}]},{"content":"The identities of the individuals or entities who operated the 16 accounts have not been publicly established. No formal law enforcement action has been confirmed as of September 2026. The exact USD profit figure from the scheme has not been disclosed beyond the 'six figures' characterization in ZachXBT's reporting; no independent audit of the on-chain evidence has been published. It is not known whether the same operators have re-emerged under new accounts following the suspensions. The connection between the account operators and the $ORAMAMA token deployer wallet has not been publicly established in chain-of-custody detail beyond the ZachXBT thread.","heading":"Limitations and Open Questions","severity":"low","sources":[{"credibility":2,"name":"ZachXBT on X — original thread","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT on X — original investigation thread (post 6)","type":"social_media","url":"https://x.com/zachxbt/status/2035989271652466773"},{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"news_article","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ORAMAMA / SOL on Solana / PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — Finance Feeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Social Media Network Using Fake News to Promote Crypto Scams — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-exposes-social-media-network-using-fake-news-to-promote-crypto-scams"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — Coin Edition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic To Fuel Pump-and-Dump Crypto Scams — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"credibility":2,"name":"ZachXBT Uncovers 10+ X Accounts Driving 6-Figure Crypto Scams With AI Tactics — Castle Crypto","type":"news_article","url":"https://castlecrypto.gg/news/zachxbt-uncovers-10-x-accounts-driving-6-figure-crypto-scams-with-ai-tactics/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — MEXC News","type":"news_article","url":"https://www.mexc.com/news/975803"},{"credibility":2,"name":"ZachXBT: X Networks Use Fake War News for Crypto Scams — CryptoNewsZ","type":"news_article","url":"https://www.cryptonewsz.com/zachxbt-networks-fake-war-news-crypto-scams/"},{"credibility":2,"name":"US-Iran War Related Panic Is Being Used for Crypto Scams — CoinGape","type":"news_article","url":"https://coingape.com/us-iran-war-related-panic-is-being-used-for-crypto-scams-zachxbt/"},{"credibility":2,"name":"ZachXBT Exposes X Doomposting Ring — Tekedia","type":"news_article","url":"https://www.tekedia.com/zachxbt-exposes-x-doomposting-ring/"}],"summary":"$ORAMAMA is a Solana-based meme token that served as the vehicle for a coordinated pump-and-dump scheme identified by on-chain investigator ZachXBT. On February 22, 2026, ten accounts within a larger 16-account network on X simultaneously promoted the token after building audiences through AI-assisted fabrication of US-Iran war panic content, then abandoned all mention of it once operators had exited their positions for six-figure profits. X suspended all 16 identified accounts following ZachXBT's public disclosure on March 23, 2026.","timeline":[{"date":"2026-02-22","event":"Ten X accounts within the 16-account network simultaneously promoted $ORAMAMA token on Solana via PumpSwap, generating a coordinated price pump. Operators allegedly exited positions for six-figure profits. Accounts never mentioned $ORAMAMA again.","source":"ZachXBT on X / Blockchain.news","source_url":"https://x.com/zachxbt/status/2035989271652466773"},{"date":"2026-03-23","event":"ZachXBT published a public thread exposing the 16-account coordinated network, detailing the geopolitical fear content tactics, AI-generated personas including a fabricated impersonation of Mario Nawfal, and on-chain evidence of six-figure profits from the $ORAMAMA pump-and-dump.","source":"ZachXBT on X / The Daily Hodl / Finance Feeds","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/amp/"},{"date":"2026-03-23","event":"Following ZachXBT's disclosure, X (formerly Twitter) suspended all 16 identified accounts. ZachXBT noted the accounts had blocked him shortly after his thread went live.","source":"Castle Crypto / The Daily Hodl","source_url":"https://castlecrypto.gg/news/zachxbt-uncovers-10-x-accounts-driving-6-figure-crypto-scams-with-ai-tactics/"}]},"v":1}