A new investigation by blockchain sleuth ZachXBT alleges that a coordinated cluster of fake X accounts used war-related fear to drive users into cryptocurrency scams. The operation, described as the “Fear Network,” allegedly relied on AI-generated personas, repurposed social-media accounts and fast-moving narrative manipulation to convert panic-driven attention into on-chain profits.
The alleged scheme highlights a more sophisticated form of crypto fraud, one that uses geopolitical anxiety not just as background noise but as the main engine for distribution and engagement. Rather than promoting scams in isolation, the network is said to have first built reach through viral conflict-related content before redirecting that audience toward fake giveaways and low-liquidity token promotions.
1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.
Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam… pic.twitter.com/uMjCSQUzwp— ZachXBT (@zachxbt) March 23, 2026
How the network allegedly turned panic into profit
According to the investigation, the operators spread exaggerated or fabricated war-themed posts through a web of interconnected X accounts designed to look independent and credible. One of the identities cited in the report was an AI-generated persona called “Rashid bin Saeed,” which fit into a broader pattern of synthetic profiles used to push coordinated narratives.
The accounts did not allegedly rely only on fake identities, but also on purchased handles with existing followers to accelerate trust and visibility. By acquiring older accounts and farming engagement aggressively, the network reportedly avoided the slow process of building credibility from scratch and instead moved quickly into high-visibility posting.
Once traffic and engagement peaked, the same accounts allegedly pivoted from geopolitical content to crypto promotions, including fake giveaways and coordinated buying campaigns in obscure tokens. ZachXBT cited the Solana-based meme token $ORAMAMA as one example used in these schemes, with the alleged operators then selling into the price spike after drawing in outside buyers.
Why the alleged operation is harder to track
The report says the group layered several tactics together to reduce traceability, including cross-posting, account purchases, AI-generated personas and rapid username changes after promotions were completed. That structure was allegedly designed to preserve the appearance of legitimacy just long enough to exploit a burst of attention and then obscure the trail once the campaign had run its course.
What makes the alleged network especially notable is that it appears to have treated fear itself as a market catalyst, using geopolitical stress to create temporary liquidity in low-cap tokens. For traders, that means sudden volume in obscure assets tied to highly emotional social-media narratives should be treated as a potential warning sign rather than as a clean signal of genuine demand.
The investigation also points to a broader moderation and enforcement problem, because purchased accounts and AI-generated personas can undermine many of the basic signals platforms usually rely on to identify coordinated abuse. Quick username changes, recycled follower bases and synthetic identities make attribution more difficult and increase the need for better cross-platform tracing and stronger scrutiny of viral posts with weak provenance.
ZachXBT estimated that the network generated six-figure on-chain proceeds, although that figure had not been independently verified at the time of publication. Even with that caveat, the exposé suggests that crypto scams are evolving beyond simple spam tactics and are increasingly merging social engineering, narrative warfare and market manipulation into a single playbook.
