Blockchain investigator ZachXBT has identified a coordinated network of more than 10 accounts on X that manufactured viral panic about war and geopolitics to funnel traffic into cryptocurrency scams. The scheme exploited heightened public attention on the ongoing U.S.-Iran conflict to build large audiences before pivoting to fraudulent token promotions.
In a detailed thread posted on March 23, ZachXBT outlined the network’s strategy: operators purchased existing accounts with established followings and then used AI to fabricate personas.
One example involved creating what ZachXBT described as an AI-generated Asian version of well-known blogger Mario Nawfal. The accounts posted exaggerated or entirely fabricated breaking news multiple times per day to rapidly build engagement.
From Fear-Mongering to Pump-and-Dump Schemes
The fraud followed a repeatable sequence. First, accounts published attention-grabbing posts tied to conflict narratives, including fabricated claims about Iranian strike lists targeting civilian infrastructure.
Connected accounts then amplified the content through reposts, boosting reach across the platform. Once engagement peaked, the operators introduced scam-related content, typically fake giveaways or direct promotions of low-liquidity tokens.
ZachXBT noted that on February 22, 2026, approximately 10 accounts within the network simultaneously promoted a token called ORAMAMA in what appeared to be a coordinated pump-and-dump operation. On-chain data revealed the scheme generated six-figure profits in U.S. dollars, and the accounts never mentioned the token again afterward.
Extreme Fear Creates Fertile Ground for Manipulation
“It’s scary to think about the implications of it if a nation-state actor operated the same scheme rather than a meme coin scammer, given how easy it is to operate,” ZachXBT said, highlighting the broader vulnerability of social platforms to coordinated manipulation campaigns.
The exposure comes as the Crypto Fear and Greed Index registered a reading of 8 on March 23, matching levels last seen during the FTX collapse in late 2022.
The index has remained in extreme fear territory for over 34 consecutive days, creating conditions that amplify sensational narratives and make engagement-farming tactics more effective. ZachXBT suspects the same accounts are currently building engagement in preparation for another scam campaign.
The accounts frequently changed usernames after running campaigns, making it harder to track the network and allowing the same profiles to appear unrelated over time. ZachXBT noted that numerous large, legitimate accounts unknowingly boosted the posts by replying to or quoting the fear-driven content.
The revelation highlights persistent vulnerabilities on social media platforms, even as X has introduced enhanced anti-bot detection and content flagging for AI-generated material in recent months.
