Scott Simon, a longtime NPR host, lost control of his X account after attackers used it to publish cryptocurrency-related posts. The breach drew quick attention because Simon’s account has long been treated as a trusted source of news and commentary. Steve Inskeep said Simon did not endorse any digital asset promotions that appeared during the compromise and warned followers not to trust those posts.
Compromised account was used to spread crypto content
According to the report, Simon confirmed through a message relayed by Inskeep that the account had been breached and that recovery efforts were in progress. Simon also said the platform has helped him connect with audiences since 2009. After the unauthorized activity surfaced, the account, which had more than 971,000 followers, was quickly restricted, and its posts became visible only to approved followers.
The restriction had a clear purpose: cut off the reach of malicious links before they spread wider. It was a fast containment step. Once visibility was limited, attackers had less room to use the account’s audience as a distribution channel.
Verified media accounts remain attractive targets
The article places the incident within a broader pattern. Cybercriminals have continued targeting journalists and media figures with large audiences, using their credibility to make fraudulent crypto content look legitimate. Common entry points include phishing messages and impersonation attempts. After access is obtained, the attackers promote tokens or direct users to suspicious platforms.
Recent examples show the same playbook. A verified account tied to the New York Post was previously accessed by hackers, who impersonated Paul Sperry and tried to draw users into a fake crypto interview. Nick Robinson also suffered a similar compromise after interacting with a phishing attempt, and his account later pushed a fraudulent token to followers.
The breach of Simon’s account adds to the list of cases showing how trusted media voices are being used in crypto scam operations. Quick action limited the exposure in this case, but the tactic remains active.