Coordinated Network Uses Viral Content to Promote Crypto Scams

A coordinated network of over 10 X accounts has been identified for directing traffic to cryptocurrency scams through viral content related to war and politics. According to Foresight News, on-chain detective ZachXBT revealed that the network typically purchases accounts with existing followers and posts doomsday content multiple times daily. These posts are then amplified through retweets by smaller accounts, promoting fake giveaways or scams, and eventually changing usernames to avoid detection. ZachXBT noted that these accounts have been known to buy other people's accounts and use AI to forge identities, creating viral content by exaggerating or fabricating news. This strategy has resulted in millions of views and thousands of likes and replies daily, with many large accounts unknowingly further spreading the posts. On February 22, 2026, all 10 accounts promoted a pump-and-dump scam token named ORAMAMA, which was never mentioned again. On-chain evidence indicates that this scam profited in the six-figure range in USD. ZachXBT suspects that these accounts are currently accumulating traffic for their next scam and warns that if such tactics are adopted by state-level actors, the consequences could be severe. He calls for platforms to ban manipulative behavior and pursue legal accountability. The confirmed accounts involved include BinsaeedRashid, cn_redoracle, wanglaurentceo, bdcryptoguru, Whale_Guru, BaronDominus, ItsAnonApe, antmillionsbot, CNBlockIntel, sungleeiq, and rami_hashimi, with some accounts having changed their names up to 40 times.