ZachXBT

On-chain sleuth ZachXBT has identified connections between the hack of two Hollywood celebrities’ X accounts — which were used to create meme coin scams — and the convicted UK hacker Gurvinder Bhangu, aka Gurv.
In an X thread today, July 30, well-known anonymous crypto investigator ZachXBT <a href="https://x.com/zachxbt/status/1818245914580120015" target="_blank" rel="noopener noreferrer nofollow">revealed</a> his research into two recent high-profile X account hacks. The compromised accounts of actors Sydney Sweeney and Bob Odenkirk were used to advertise scam meme coins that reportedly generated $530,000 in stolen funds.
According to ZachXBT’s investigation, on July 2, Sweeney’s X account was <a href="https://x.com/IoachimViju/status/1808216295449502083" target="_blank" rel="noopener noreferrer nofollow">compromised</a> and posts promoting a Solana-based token dubbed “$SWEENEY” began to appear from the actor’s hacked account. Within two hours, the scam token saw over $10 million in trading volume, causing its price to spike and then crash.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 2/ On July 2nd Sydney Sweeney was SIM swapped and a link to a meme coin was posted causing the price to spike and crash. Team wallets from the SWEENEY scam sold $515K+ Main team wallets AgySZeAtqM3iSbvMPxv2g94oTd3segx4WdKuFD7M5CEr jQEaiiAkRGhFoCDnjxn6mmtrksC4EckF38fxkaNMs1j <a href="https://t.co/Vm0txgjl7B" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/Vm0txgjl7B</a>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1818245923971223904?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">July 30, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
The attack coincided with reports that Sweeney’s Verizon phone number was reportedly hijacked. 404 media <a href="https://www.404media.co/sydney-sweeneys-verizon-phone-number-hijacked/" target="_blank" rel="noopener noreferrer nofollow">obtained</a> a Verizon receipt from the same day, indicating a $37.54 payment order, confirming that Sweeney was the victim of a sim-swapping attack.
You might also like: <a href="https://crypto.news/hackers-target-okx-customers-in-suspected-sim-swap-attack/" rel="noopener noreferrer nofollow"> Hackers target OKX customers in suspected SIM swap attack </a>
According to ZachXBT, Gurv — previously convicted in the U.K. for hacking Instagram accounts and blackmailing users —&nbsp;received verification codes for Sweeney’s account via Telegram, strengthening the link between Gurv and the hack.
ZachXBT highlighted that the hacker used the same Telegram user ID to receive the code across multiple groups, discussing his time in prison and linking it to the hacks.
The crypto investigator added that proceeds from the attack were initially transferred as Solana (<a href="https://crypto.news/price/solana/" target="_blank" rel="noopener noreferrer nofollow">SOL</a>) to an exchange, where the funds were swapped for Bitcoin (<a href="https://crypto.news/price/bitcoin/" target="_blank" rel="noopener noreferrer nofollow">BTC</a>) and Ethereum (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noopener noreferrer nofollow">ETH</a>) before being dispersed to several addresses. According to ZachXBT, the on-chain activity suggests that there were multiple people involved in the scam.
You might also like: <a href="https://crypto.news/metallicas-x-account-hacked-to-promote-solana-token-sahil-arora-blamed/" rel="noopener noreferrer nofollow"> Metallica’s X account hacked to promote Solana token, Sahil Arora blamed </a>
The investigation revealed that on July 9, another 1.5 ETH as sent to an exchange from a wallet connected to the Sweeney SIM swap.
<h2 class="wp-block-heading" id="odenkirk-also-hacked">Odenkirk also hacked</h2>
The investigator linked the Sweeney hack to another extremely similar attack on actor Bob Odenkirk’s X account, also on July 9. After compromising Odenkirk’s X account, the hacker(s) launched and posted about two scam meme coins, KIRK and SAUL. Possibly because the two coins diverterted attention, this time the scammers ended up stealing fewer funds.
At the time of ZachXBT’s reporting, the wallets connected to both the Sweeney and Odenkirk scams are holding approximately $488,000. The remaining funds “have been transferred to crypto casinos and to purchase gift cards.” ZachXBT concluded the X thread with a call to local law enforcement:
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “Hopefully UK law enforcement will be quick to go after Gurv again using the large amount of evidence available.”
 
</blockquote>
The Sweeney and Odenkirck scams are part of a broader trend of celebrities promoting scam meme coins, either via <a href="https://crypto.news/metallicas-x-account-hacked-to-promote-solana-token-sahil-arora-blamed/" target="_blank" rel="noopener noreferrer nofollow">compromised accounts </a>or, in some cases, <a href="https://crypto.news/jason-derulo-blames-sahil-arora-after-meme-coin-promotion-backfires/" target="_blank" rel="noopener noreferrer nofollow">alleged social engineering scams.</a>

UK hacker linked to compromised celebrity X accounts used to promote $530m meme coin scam: report

Table of Contents

crypto.news

Other articles published on Jul 30, 2024

Router Protocol launches mainnet for L1 solution Router Chain

Hong Kong Set to Launch Asia’s First Bitcoin Futures Inverse Product: What it Means for Traders

Unraveling US Government’s Role in Today’s Sudden Bitcoin Price Slump

Why Is TON Facing Selling Pressure?

California DMV Adopts Blockchain for Vehicle Title Transfers

Bank of England rolls out consultation paper for wholesale CBDC

Join our free newsletter for daily crypto updates!