These cryptocurrency investment scams using false information for "pump and dump" are common, and I never thought I would be caught in one.
Written by: Joel Khalili
Translated by: Luffy, Foresight News
It was a cold morning in February, at 7:30 AM, and I was still groggy after the alarm went off. I sensed something was wrong, with my phone's notification light illuminating. As my eyes adjusted to the light, I began checking the notifications.
"Congratulations, you targeted the wrong person." A message from an anonymous sender appeared on my personal Telegram account. "You have 10 minutes to return the $2,800 you scammed from me." He attached a cryptocurrency wallet address.
I was confused and searched through my messages, emails, and social media accounts. The situation quickly became clear: someone had hijacked my X account and used it to promote a fake "Wired magazine cryptocurrency". As people bought this cryptocurrency, the price began to rise, and the scammers took the opportunity to sell, leaving investors with nothing. Those who lost money were furious.
On the X platform, I found numerous intense insults, including various racial slurs from people with no understanding of world geography. "I can't believe no one has beaten you up at your workplace, you maggot," one X user wrote. "You big-nosed, thin-lipped bastard," another said. "I hope you get hit by a car," someone else commented.
Other users tried to report my supposed misconduct to my boss: "Your people are scamming money here." One person wrote on X, tagging Wired magazine's official account.
Although these messages were unpleasant, there were few direct threats besides the message from the anonymous Telegram user. "I'm gathering a lot of information about you, including your address, relatives and friends at University College London (my alma mater)," they said. "I will make your life hell if I don't receive a refund."
By 9 AM, I was still lying in bed avoiding these troubles, with my laptop on my outstretched legs. I contacted my editors, managers, and security personnel at Wired magazine, explaining what had happened and requesting help. I also messaged my partner, who replied: "Oh, damn!!!"
These cryptocurrency investment scams using false information for "pump and dump" are common, and I never thought I would be caught in one.
"This is a very common attack method. The purpose is to perform a simple pump and dump to cash out," said Phil Larratt, investigation director at blockchain analysis company Chainalysis, which helped Wired magazine analyze the mechanics of this scam. "To do this, they need a certain level of exposure, which is why they hacked into your account."
This year alone, multiple public figures' X accounts have been compromised to promote cryptocurrency pump and dump scams. BBC reporters, British and Argentine politicians, and the former vice president of the Philippines have all had their accounts used to promote fraudulent cryptocurrencies. Previously, Joe Biden, Barack Obama, and Bill Gates' accounts were also hijacked for similar cryptocurrency scams.
In theory, the more influential an X account is, the higher the potential returns for a pump and dump scam, as more people are likely to buy the cryptocurrency promoted by scammers. I rarely tweet and have fewer than 2,800 followers, making me an unlikely target. However, I was still valuable to the scammers because I could be seen as a trusted authority among cryptocurrency journalists.
"The higher the exposure during the price-raising phase, the more likely multiple investors are to believe the promotion and buy in, ultimately holding the bag when the scammers sell," said John Powers, president of private investigation firm Hudson Intelligence.
X platform did not respond to a request for comment.
Although cryptocurrency has long been used for pump and dump scams, the emergence of MEME coin issuance platforms has made such operations easier, allowing anyone to instantly create a cryptocurrency at low cost. In my case, the scammers used Pump.fun, currently the largest issuance platform, to mint a cryptocurrency with the Wired magazine brand.
"Many cryptocurrencies issued on Pump.fun are used for pump and dump. When bad actors combine pump and dump with hacking X accounts, they can potentially profit significantly if executed properly," Larratt said.
Troy Gravitt, a Pump.fun spokesperson, stated in a statement to Wired magazine: "We continuously invest in ensuring platform user safety. When we discover fraud allegations, such as hackers using X account hijacking for token fraud, we remove these tokens from the frontend to mitigate potential harm to unsuspecting users."
Despite the frequent MEME coin "pump and dump" scams, investors continue to flock to buy MEME coins. "MEME coin appreciation often occurs early in the issuance, shortly after launch," Powers said. "There's a chance you could buy at the right moment and make a fortune... timing is everything. For many, the legitimacy of the project is a secondary consideration."
I realized my X account was taken over on February 17, the day before the Wired magazine cryptocurrency scam was launched. "Have I Been Pwned" (a service helping people check if their information was exposed in data breaches and hacks) showed that my X account credentials were previously sold on a hacker forum, providing a possible explanation for the account compromise. Critically, I hadn't set up two-factor authentication, meaning the scammers only needed my password to control my account.
Since the scammers changed my recovery email, I had to go through a long and difficult account recovery process with the X platform, which meant I couldn't immediately regain control of my account. By the next morning, it was too late. Analysis of transaction data showed that the hackers who broke into my X account created the Wired magazine token at 1:20 AM that day.
When someone creates a cryptocurrency on Pump.fun, they issue 10 billion tokens into circulation and typically buy some at a symbolic price themselves. According to Powers and Chainalysis' analysis, in this case, the scammers purchased about 5% of the total supply using the token issuance wallet, then acquired more tokens with two additional wallets immediately after trading began. They used these auxiliary wallets to conceal their holdings from investors. "You can buy a certain amount of your own issued tokens. But if you buy a lot, no one will buy in because it looks very suspicious," Larratt said.
Overall, the scammers controlled about 12% of the total circulating Wired magazine tokens, a large enough amount that if they sold, would cause the token price to plummet.
At 1:23 AM, the scammers began promoting this cryptocurrency on my X account; other X users' posts indicated they even went live on Spaces. Although they later deleted various posts, which were gone by the time I woke up, screenshots captured by other X users revealed their fabricated scam.
Last weekend, Argentine President Javier Milei was involved in a scandal involving a cryptocurrency called "Libra" (Milei denied any wrongdoing). The scammers claimed on X that Wired magazine would launch its own cryptocurrency, related to the Milei incident. "I spoke with the people behind 'Libra'... this might be the most interesting report I've written. He detailed the setup, process, and cash-out method, and we even launched our own MEME coin to show how easy it is," the scammer wrote in a post on my X account.
In the next few minutes, some human traders and bots programmed to buy newly issued cryptocurrencies began investing. As they bought in, the price of the cryptocurrency started to rise. At 1:36 AM, 16 minutes after trading began, the total value of this MEME coin peaked at $300,000. Then the scammers began selling.
On the Raydium trading platform, they dumped these tokens into the market through a series of quick trades, with analysts estimating they profited around $8,000 to $10,000. At 1:45 AM, the Wired magazine token was almost reduced to zero.
"Compared to other pump and dump scams we've seen, they didn't make much money this time. But in just 20 minutes, their earnings could be five times their initial investment," Larratt said.
At 2 AM, the proceeds from selling the Wired magazine token were transferred to another wallet through a series of interconnected accounts. According to Chainalysis's analysis, this wallet might be associated with a cryptocurrency exchange service, where these proceeds were mixed with cryptocurrencies worth hundreds of thousands of dollars from other unknown sources.
On February 19 and 24, that wallet deposited cryptocurrencies totaling $110,000 into Binance.
After that, the trail went cold. Although cryptocurrency exchanges in most jurisdictions are required to record account holder identities, they will not disclose this information unless requested by authorities.
"We will not disclose account holder identities to the media, out of respect for our law enforcement colleagues to ensure the fairness of any ongoing investigation and to prevent innocent users from being misidentified," Binance stated.
Larratt previously told Wired magazine that criminals often use "money mules" (people hired to transfer illegal funds) or stolen identity documents to open accounts at exchanges, meaning identifying an account owner does not equate to identifying the scammer.
In the days following the Wired magazine MEME coin pump and dump scam, I continued to receive messages from people who believed I had scammed them. As before, the most explicit threat messages came from an anonymous Telegram user.
"If you think I'm joking, you're very much mistaken," they wrote in one message, threatening to report me to Wired magazine's management, "Do you really think you can escape punishment?" they said in another message.
Although I suspected these threats were bluffing, they were still unsettling. To reduce the possibility of someone finding me, I registered a service that promised to clear my personal data fragments from the internet. I also contacted my friends and family, who were indirectly threatened, and reported this harassment to local police.
A week later, after I posted an explanation about what happened on my X account, those abusive and threatening messages stopped.
Meanwhile, people continue to pour into the uncertain MEME coin space. Third-party data shows that the MEME coin issuance platform Pump.fun, by charging a 1% fee on transactions, earns between $1 million to $2 million daily.
On April 14, the anonymous Telegram user who threatened me posted two screenshots on X, boasting about the huge profits they made in a recent MEME coin trade. He wrote: "We are so stupid." This phrase uses a derogatory term common among Memecoin traders to boast about their willingness to take risks. Finally, he ended the post with an emoji with dollar sign eyes.
