ZachXBT flags coordinated crypto scams through war posts on X

A cluster of social media accounts used war-related content to funnel users into crypto scams, according to findings shared by on-chain investigator ZachXBT.

In a recent thread on X, he outlined how more than 10 accounts worked together during the ongoing Middle East conflict to attract attention and redirect it toward fraudulent crypto promotions.

The strategy relied on emotionally charged posts about war and politics, designed to capture engagement from users already following fast-moving global developments, before shifting that traffic into scam campaigns.

How war content drives engagement

ZachXBT said the operators behind the network acquired existing accounts that already had followers.

These accounts then began posting frequent updates focused on negative or alarming developments linked to war and politics.

The posts appeared several times a day and were structured to trigger reactions.

By tapping into ongoing conflict coverage, the accounts positioned themselves within high-traffic conversations.

This increased visibility without relying on original credibility or verified information.

He described the approach as engagement farming tied directly to fraud.

The posts were designed to generate replies, reposts, and visibility, creating a pipeline of attention that could later be redirected.

Coordinated scam pattern

The activity followed a repeated sequence. First, the accounts published attention-grabbing posts linked to conflict narratives.

Then, connected accounts amplified the same content through reposts, boosting reach across the platform.

Once engagement levels increased, the operators introduced scam-related content.

This typically included fake giveaways or direct promotions tied to crypto assets.

The shift from news-style posts to scam messaging was gradual, making it less noticeable to casual users.

ZachXBT added that the accounts frequently changed usernames after running campaigns.

This made it harder to track the network and allowed the same profiles to appear unrelated over time.

Using multiple accounts also enabled the group to repeat the process across different topics and audiences.

Wider reach through unsuspecting users

Some large accounts on X interacted with the posts without knowing their origin or purpose.

These replies and reposts further increased the visibility of the content, pushing it into wider user feeds.

The method relied heavily on social engineering. Users are more likely to respond quickly to negative or urgent updates, especially during conflict-driven news cycles.

This behaviour increases the chances of posts trending or appearing prominently in feeds.

As a result, scam promotions embedded within these engagement cycles reached a broader audience than standard spam tactics.

On-chain links to crypto fraud

ZachXBT said on-chain data connected the network to pump-and-dump crypto schemes.

Ten accounts within the cluster were identified as actively promoting these scams.

He noted that on-chain evidence suggests the operation generated six-figure profits.

This ties the social media activity directly to financial outcomes rather than isolated or opportunistic spam.

The findings also point to a broader risk. The same model could be scaled further, given how easily coordinated posts can influence visibility on large platforms.