On-chain investigator ZachXBT said a coordinated network of more than 10 X accounts used war-related and political posts to pull attention before redirecting users to crypto scams. According to his thread, the operators did not build audiences from scratch. They bought accounts that already had followers, then flooded timelines with negative updates tied to the ongoing Middle East conflict.
Fear-driven posts were used to build reach first
ZachXBT said the accounts posted repeated alarming updates several times a day to attract users closely watching fast-moving global events. The content was built for reactions. Replies, reposts, and outrage helped widen distribution, and once the accounts gained enough visibility, they shifted toward crypto scam promotions.
He described the method as engagement farming linked to fraud. The sequence was consistent: publish emotionally charged posts, have connected accounts repost the same messages to boost exposure, then move in with fake giveaways, direct scam offers, or other misleading crypto promotions.
Username changes made the network harder to trace
The pattern did not stop with reposting. ZachXBT said the operators often changed usernames after campaigns ended, making it harder to connect the same accounts over time. Running several accounts at once also let the group recycle the same playbook across different topics and audiences without looking identical at first glance.
He added that some large X accounts interacted with the posts without knowing who was behind them or why they were being pushed. That gave the content extra reach. The tactic leaned heavily on social engineering: users tend to react quickly to negative or alarming war-related posts, and that reaction can lift scam-linked content higher in the feed.
On-chain evidence pointed to six-figure profits
ZachXBT said 10 accounts in the tracked cluster promoted pump-and-dump crypto scams. He wrote that on-chain evidence suggests the scheme profited six figures, tying the social media activity to actual financial gains rather than random spam. In his view, the risk goes beyond one cluster of accounts, because the same technique can be repeated at much larger scale.
He also said platform manipulation of this kind should face bans and legal action. His warning focused on how coordinated false posts can spread quickly on X, especially when they are attached to emotionally charged topics and then redirected toward crypto fraud.