On-Chain Analyst Ties Three Recent X Hacks, Including Roaring Kitty’s, to Same Organized Group

A series of high-profile X account compromises over the past month, including the hack of GameStop meme stock figure Roaring Kitty, have been attributed to a single organized group, according to on-chain analyst Specter. The findings shed light on a coordinated scheme that has netted over $14 million through fraudulent token launches and phishing attacks.

How the Roaring Kitty Hack Unfolded

On May 11, Roaring Kitty’s X account was compromised, and shortly after, a Solana-based memecoin named RKC was issued. Specter’s analysis reveals that the hackers had pre-loaded several wallets with the token before the account was taken over. As the price of RKC surged following the announcement, the attackers sold their holdings, securing over $600,000 in profits.

“By tracing the wallet fund flows, it was determined that this group had accumulated over $14 million by issuing fraudulent tokens like USOR and VDOR using the same method,” Specter explained in a detailed post on X. The pattern of compromise and token launch appears consistent across at least three incidents in the past month.

Broader Network of Fraud

The analyst’s investigation uncovered a wider network of fraudulent activity. The same group reportedly uses influencers on platforms like Telegram to promote their schemes, creating artificial buying pressure that serves as exit liquidity for their pre-loaded positions. This pump-and-dump strategy relies on the trust of retail investors who believe they are getting in early on a legitimate project.

Further deepening the concern, the fund trail from these recent hacks overlaps with a $2.45 million wstETH phishing attack that occurred in 2024. This connection suggests the group has been active for at least a year, refining their methods and targeting high-profile accounts to maximize impact.

What This Means for Users

“This is an organization that will use any means, including phishing and hacking, to find opportunities to make money,” Specter warned. The analyst advises users to exercise extreme caution, particularly when connecting wallets to unfamiliar platforms or clicking on links from compromised accounts. The sophistication of these attacks highlights the evolving threat landscape in the crypto space, where social engineering and technical exploits are increasingly combined.

Conclusion

The linking of three major X hacks to a single organized group underscores the growing professionalism of crypto-related cybercrime. With over $14 million in illicit gains traced to these operations, the incident serves as a stark reminder of the risks associated with social media trust and unverified token investments. Users are urged to remain vigilant and verify information through multiple independent sources before acting on any financial opportunities promoted online.

FAQs

Q1: How did the hackers gain access to these X accounts?
The exact method of compromise has not been publicly confirmed, but the pattern suggests a combination of phishing and social engineering tactics. Users are advised to enable two-factor authentication and avoid clicking on suspicious links.

Q2: What is the total financial damage attributed to this group?
According to on-chain analyst Specter, the group has accumulated over $14 million through fraudulent token launches like USOR, VDOR, and RKC, in addition to a $2.45 million wstETH phishing attack from 2024.

Q3: How can users protect themselves from similar attacks?
Never connect your wallet to unknown or unverified platforms. Be skeptical of token promotions from compromised accounts, even if they appear to come from trusted figures. Always verify information through official channels and independent news sources.