ZachXBT has once again demonstrated how well-planned and coordinated cryptocurrency frauds have become. He discovered a well-organised network of over a dozen X accounts in a thorough thread.

The synchronisation of everything from account setup to content amplification to the final scam push is what makes this scenario remarkable. This was a replicable system intended to take advantage of attention at scale, not chaos.

• The Playbook: Bought Accounts, Fake Identity, Constant Posting
• Network Amplification: How Virality Was Engineered?
• The Scam Phase: $ORAMAMA & the Exit Pattern
• Exposure, Blocking, & Mass Suspension

The Playbook: Bought Accounts, Fake Identity, Constant Posting

ZachXBT's investigation is centred around a specific operational pattern. The accounts were bought with pre-existing followers, providing the operator with an instant following, rather than growing naturally.

@wanglaurentceo (User ID: 1804235884826333184) is one such example. ZachXBT claims that the account had been turned into an AI-generated persona, which they refer to as a counterfeit "Asian version" of a well-known influencer. Here, credibility was more important than originality. Users are more likely to trust what they see when an identity appears familiar.

After being rebranded, these accounts took off. They posted several times a day, with a strong emphasis on geopolitical news that was frightening or overblown. The goal was straightforward, i.e., to elicit emotional responses and maintain user interest long enough for the subsequent stage.

Network Amplification: How Virality Was Engineered?

ZachXBT emphasised that these accounts moved as a unit rather than functioning independently. Reposting and interacting with each other's posts regularly caused a group of associated profiles to artificially inflate engagement.

Posts received the initial boost from this internal boosting that allowed them to gain more prominence. The actual acceleration started after that. Unknowingly feeding into the system, larger, unrelated accounts began commenting on and quote-tweeting these posts.

1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.

Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam… pic.twitter.com/uMjCSQUzwp

— ZachXBT (@zachxbt) March 23, 2026

The Scam Phase: $ORAMAMA & the Exit Pattern

The network moved toward monetisation after gaining traction. ZachXBT discovered a concerted effort centred around the cryptocurrency token $ORAMAMA.

The token was concurrently promoted by at least ten network accounts on February 22, 2026. This was a concentrated wave intended to generate urgency and draw in customers, not a casual mention.

6/ Ten X accounts in the cluster all promoted the pump and dump crypto scam $ORAMAMA on February 22, 2026 before never posting about it again.

Onchain evidence suggests the scheme profited six figures.

I suspect they are farming engagement once again for another upcoming scam. pic.twitter.com/yTmDtIDvEd

— ZachXBT (@zachxbt) March 23, 2026

A pump-and-dump tactic is directly aligned with the accounts' total abandonment of the coin. According to on-chain data associated with the activity, the business made six-figure earnings before its closure.

Exposure, Blocking, & Mass Suspension

Nearly at the same time, all 11 of the accounts that were first identified blocked him. ZachXBT looked further and found five more accounts with the same structure:

1. Jihooncrypto - 3846842218
2. raqeem_saudi - 1238542124129320960
3. mrcryptowhalecn - 2707360046
4. seongwooiq300 - 1780190681756999680
5. iq300min - 2868821473

X intervened and suspended all 16 accounts shortly after this increased exposure. The suspensions supported ZachXBT's conclusions and verified the scope of the activity.

It also demonstrated how quickly these networks can vanish after being discovered, just to perhaps reappear under different names.

ZachXBT's view that the operators were already getting ready for another round is one of the thread's more troubling details. It's not a one-time fraud because of how structured the process is i.e., to purchase accounts, rebrand, create virality, promote a cryptocurrency, and then go. The model can be reused.

A single coordinated entity administering the entire network is implied by the fact that all accounts blocked him simultaneously, promoted the same coin on the same day, and disappeared from it equally rapidly.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. After CoinDCX: Where Should Indian Crypto Users Actually Trade?
2. USDC Drives Polygon Stablecoin Supply to $3.46B ATH
   
3. Vitalik Aligns with Ethereum Foundation’s Long-Term Vision
4. T-REX Ledger Brings Compliance to Multi Chain Markets
5. Fidelity Launches USD-Backed Stablecoin FIDD

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.