Audit log

Every state-changing event for ZachXBT Fake War Posts Crypto Scam Network: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-07 12:20:52Z
   Score: ? → ? (no score change)
   anchorfailed

   chain

   ●—

   hash

   5EqknBbm6eDo…54Rmf6XCcopysha256 → base58

   verifying row…

   canonical bytes (12085 B) ▸

   {"actor":"system:backfill","investigation_id":"391ddca4-d5e2-4e6b-b268-add728ac9f67","kind":"publish","page_slug":"zachxbt-fake-war-posts-crypto-scam-network","published_at":"2026-10-07T12:20:52.610Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ZachXBT Fake War Posts Crypto Scam Network","sections":[{"content":"On March 23, 2026, blockchain investigator ZachXBT published a thread describing a coordinated network of more than ten X accounts that manufactured or grossly exaggerated breaking-news-style war and geopolitical content, timed around heightened public attention on Iran-related tensions, to rapidly accumulate views and engagement. According to the thread, the accounts followed a repeatable playbook: purchase an existing account with a pre-existing follower base, post alarmist or fabricated 'doompost' content multiple times per day, cross-repost material between the linked accounts to manufacture apparent virality, then pivot the resulting audience toward fake giveaways or scam token promotions before changing the account's username to evade tracking. One cited example involved an account, @wanglaurentceo (operating as 'Wang Laurent'), which allegedly used an AI-generated image to create a fabricated persona resembling commentator Mario Nawfal, and accumulated tens of thousands of followers while cycling through more than a dozen username changes. One post falsely claiming Iran had threatened to sever undersea internet cables reportedly drew roughly 1.8 million views and tens of thousands of engagements even after X's Community Notes flagged it as inaccurate.","heading":"The scheme: fake war content as a traffic funnel into crypto scams","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT original thread (via Thread Reader App)","type":"social_media","url":"https://threadreaderapp.com/thread/2035989255395082589"},{"credibility":2,"name":"Crypto Scam Ring Used AI and Geopolitical Posts to Go Viral on X — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-scam-ring-used-ai-and-geopolitical-posts-to-go-viral-on-x/"}]},{"content":"ZachXBT's investigation reported that on February 22, 2026, approximately ten accounts within the network simultaneously promoted a Solana-based token called $ORAMAMA, launched via PumpSwap, in what he characterized as a coordinated pump-and-dump operation. Per his account, the accounts posted about the token a single time and never referenced it again afterward. ZachXBT stated that on-chain evidence indicated the scheme generated profits in the low six figures (U.S. dollars), though the specific on-chain transactions were not independently published in the secondary reporting reviewed. No regulatory body or law enforcement agency has been identified in available reporting as having opened a formal action specifically tied to the $ORAMAMA promotion.","heading":"ORAMAMA pump-and-dump and alleged financial impact","severity":"high","sources":[{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT flags coordinated crypto scams through war posts on X — Invezz","type":"news_article","url":"https://invezz.com/ie/news/2026/03/23/zachxbt-flags-coordinated-crypto-scams-through-war-posts-on-x/"}]},{"content":"Multiple outlets reported that shortly after ZachXBT published his thread, all identified accounts in the network (reported variously as 10 to 11 accounts) blocked him on X simultaneously. ZachXBT characterized this as evidence the accounts were \"operated by one person\" rather than being an organically distributed set of independent actors, since unrelated accounts would have no shared reason or mechanism to block a single critic at the same moment. This detail is reported consistently across the secondary coverage reviewed but traces back to ZachXBT's own account of events rather than to independently verified platform data, and should be read as his allegation rather than a confirmed, third-party-audited finding.","heading":"Simultaneous blocking suggests single-operator coordination","severity":"medium","sources":[{"credibility":2,"name":"If Meme Coin Scammers Can Do This, What Happens When a Nation-State Tries? — CoinStats","type":"news_article","url":"https://coinstats.app/en/news/14fe5897115ca62786925a1f88090a4d1e27a43ab929f57a091fe6a33532a353_If-Meme-Coin-Scammers-Can-Do-This-What-Happens-When-a-Nation-State-Tries-ZachXBT-Warns/"},{"credibility":2,"name":"ZachXBT original thread (via Thread Reader App)","type":"social_media","url":"https://threadreaderapp.com/thread/2035989255395082589"}]},{"content":"ZachXBT and subsequent commentary characterized this network as representing a tactical shift from traditional crypto scam formats — such as fake celebrity-endorsed giveaways or romance-style 'pig butchering' schemes — toward exploiting fear and urgency generated by real or fabricated geopolitical crises. ZachXBT was quoted as saying it is \"scary to think about the implications of it if a nation-state actor operated the same scheme rather than a meme coin scammer, given how easy it is to operate,\" framing the technique as a reusable and scalable information-manipulation vector beyond financial fraud alone. As of the most recent reporting reviewed, ZachXBT suspected the same operator(s) could be rebuilding engagement in preparation for a further scam campaign under new account identities, though this is presented as his assessment and has not been independently confirmed.","heading":"Novel tactic and broader risk assessment","severity":"medium","sources":[{"credibility":2,"name":"If Meme Coin Scammers Can Do This, What Happens When a Nation-State Tries? — CoinStats","type":"news_article","url":"https://coinstats.app/en/news/14fe5897115ca62786925a1f88090a4d1e27a43ab929f57a091fe6a33532a353_If-Meme-Coin-Scammers-Can-Do-This-What-Happens-When-a-Nation-State-Tries-ZachXBT-Warns/"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"}]},{"content":"Available reporting reviewed for this investigation does not identify any law enforcement agency, regulator, or platform operator as having taken a confirmed, named enforcement action specifically against this network as of the most recent coverage located (late March 2026). ZachXBT called on platforms to suspend the accounts and for \"platform manipulation\" to \"lead to bans and legal consequences,\" but no such outcome has been independently verified in the sources reviewed. This absence of confirmed action should not be read as evidence the network is inactive; ZachXBT's own commentary suggests the operators may continue under new account identities.","heading":"No confirmed enforcement action","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT Exposes Fake Accounts Driving Crypto Scams on X — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"credibility":2,"name":"ZachXBT Exposes Network Using Political Fear for Crypto Scams — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605298296"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"Crypto Scam Ring Used AI and Geopolitical Posts to Go Viral on X — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-scam-ring-used-ai-and-geopolitical-posts-to-go-viral-on-x/"},{"credibility":2,"name":"ZachXBT flags coordinated crypto scams through war posts on X — Invezz","type":"news_article","url":"https://invezz.com/ie/news/2026/03/23/zachxbt-flags-coordinated-crypto-scams-through-war-posts-on-x/"},{"credibility":2,"name":"Crypto scam network used war fear on X, says ZachXBT — crypto.news","type":"news_article","url":"https://crypto.news/crypto-scam-network-used-war-fear-on-x-says-zachxbt/"},{"credibility":3,"name":"Crypto scam network exposed: Fake war panic drives fraud — Tangem","type":"news_article","url":"https://tangem.com/en/news/security/19125-crypto-scam-network-exposed-fake-war-panic-drives-fraud/"},{"credibility":2,"name":"If Meme Coin Scammers Can Do This, What Happens When a Nation-State Tries? — CoinStats","type":"news_article","url":"https://coinstats.app/en/news/14fe5897115ca62786925a1f88090a4d1e27a43ab929f57a091fe6a33532a353_If-Meme-Coin-Scammers-Can-Do-This-What-Happens-When-a-Nation-State-Tries-ZachXBT-Warns/"},{"credibility":2,"name":"ZachXBT original thread (via Thread Reader App)","type":"social_media","url":"https://threadreaderapp.com/thread/2035989255395082589"},{"credibility":3,"name":"ZachXBT exposes a social media manipulation network using fake war news to funnel traffic into crypto scams — OneKey","type":"news_article","url":"https://onekey.so/blog/ecosystem/zachxbt-exposes-a-social-media-manipulation-network-fake-war-news-used-to-funnel-traffic-into-crypto-scams-worth-hundreds-of-thousands-20260323174227"}],"summary":"In March 2026, on-chain investigator ZachXBT publicly exposed a coordinated network of more than ten purchased X (Twitter) accounts that posted fabricated or exaggerated war and geopolitical content to build large audiences, then pivoted to promoting crypto giveaway scams and at least one pump-and-dump token. All identified accounts blocked ZachXBT within hours of the thread's publication, which he said suggested single-operator control. No law enforcement or regulatory action against the network has been confirmed in available reporting as of this writing; the underlying playbook is considered reusable under new account identities.","timeline":[{"date":"2026-02-22","date_evidence":"On February 22, 2026, approximately 10 accounts within the network simultaneously promoted a token called ORAMAMA","event":"Roughly ten linked accounts simultaneously promoted the Solana token $ORAMAMA on PumpSwap, then never mentioned it again, in what ZachXBT described as a coordinated pump-and-dump.","source":"FinanceFeeds","source_url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"date":"2026-03","date_evidence":"a detailed thread posted on March 23","date_original":"2026-03-23","event":"ZachXBT published a thread exposing the network of 10+ purchased X accounts using fabricated war/geopolitical content to drive traffic into crypto scams.","source":"FinanceFeeds / Cointelegraph","source_url":"https://cointelegraph.com/news/zachxbt-fake-war-posts-x-crypto-scam-network"},{"date":"2026-03","event":"Shortly after ZachXBT's thread was published, all identified accounts in the network blocked him on X simultaneously, which he said indicated single-operator control.","source":"CoinStats","source_url":"https://coinstats.app/en/news/14fe5897115ca62786925a1f88090a4d1e27a43ab929f57a091fe6a33532a353_If-Meme-Coin-Scammers-Can-Do-This-What-Happens-When-a-Nation-State-Tries-ZachXBT-Warns/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5d3e5b19-520a-4b97-8c5c-6d4048a03beecopy