Security Alert: Hackers Impersonate X Staff Using Compromised Scroll Founder Account

In a sophisticated phishing scheme, the X account of Scroll co-founder Ye Chen was compromised, with attackers masquerading as staff from the social media platform to target key figures in the cryptocurrency sector.

Key Takeaways

Account Hijacking: Scroll co-founder Ye Chen's X account was compromised to spread phishing messages targeting crypto figures.
Manipulated Branding: Hackers altered the account profile to mimic official branding, enhancing their credibility.
Growing Trend: Social engineering attacks on crypto leaders are becoming more advanced, with hackers utilizing trusted accounts to launch phishing schemes.
Rising Theft in Crypto: In 2025, over $3.4 billion was stolen in the crypto ecosystem, with North Korean hackers being major contributors.
Security Warnings: Users are advised to remain vigilant against phishing attempts and security breaches becoming more frequent across various platforms.

Hackers Impersonate X Staff Using Compromised Scroll Founder Account

The hacked account, which wields considerable influence among leaders in the crypto community, began sending out deceptive messages claiming copyright infringements and threatening account limitations unless users clicked on malicious links within 48 hours.

To lend credibility to their scheme, the hackers altered Chen's profile to imitate X's official branding, updating the bio to mention Twitter and nCino while warning followers about potential security risks.

Scroll Founder Account Hack - Changed Profile Info

To enhance their facade, the attackers filled the feed with reposts from verified X accounts, trying to establish a sense of legitimacy before launching their phishing attacks through direct messages.

An Evolving Threat: Sophisticated Attack Mirrors Established Patterns

This incident aligns with a familiar trend where hackers exploit trusted accounts to disseminate malicious links disguised as urgent notifications from the platform.

Recipients received messages that appeared to originate from X’s rights management team, featuring fake compliance notifications and time-sensitive requests designed to incite panic and evade security precautions.

Blockchain security expert Wu Blockchain was the first to notice the breach and promptly advised the community to disregard any messages originating from the compromised account.

The warning underscored the heightened risk, given Chen’s extensive connections with high-profile cryptocurrency executives, developers, and investors who might unwittingly trust communications from his verified profile.

This attack represents a concerning escalation in the pattern of social media hacks targeting leaders in the crypto industry, with hackers becoming increasingly skilled at exploiting delegated account access and expired domains to overcome security measures such as two-factor authentication.

Ongoing Social Engineering Challenges in the Crypto Landscape

A similar incident occurred in October when BNB Chain’s official account was compromised. Hackers used the account to promote fake reward programs that included phishing links after Binance co-founder CZ issued a warning to followers about dubious content.

This breached account falsely advertised BSC token distributions, promising early payouts to users who voted on reward dates through malicious URLs, which aimed to siphon funds from digital wallets.

In December, Binance co-CEO Yi He’s WeChat account was also hacked to promote meme coin schemes, as attackers executed a coordinated pump-and-dump operation involving the token MUBARA.

In this instance, two wallets created shortly before the breach amassed 21.16 million tokens, which were swiftly sold off as retail investors rushed in, yielding the attackers approximately $55,000 while leaving subsequent buyers vulnerable to a price crash.

Noteworthy hacks also impacted ZKsync and Matter Labs, which experienced breaches in May through what the team described as “delegated accounts” with limited posting permissions.

The attackers published false information about an SEC investigation along with fake airdrop promotions, resulting in a 5% decline in the ZK token price despite an earlier 38.5% increase over the week.

Additionally, prominent crypto media outlet Watcher.Guru confirmed its account was compromised in March when misleading claims about a Ripple-SWIFT partnership circulated via connected Telegram, Facebook, and Discord channels through automated content bots.

The team speculates that this breach originated from a suspicious link with unusual query strings shared in their Telegram group weeks before the incident.

An Alarming Year for Crypto Theft and Security Breaches

According to Chainalysis's 2026 Crypto Crime Report, the cryptocurrency ecosystem experienced thefts exceeding $3.4 billion in 2025, with state-sponsored hackers from North Korea responsible for a staggering $2.02 billion of the total, as attackers are becoming more sophisticated.

Scroll Founder Account Hack - Chainalysis Chart

North Korean cyber activity now accounts for 76% of all service compromises, bringing their total cryptocurrency theft to $6.75 billion since they began these operations.

Compromises of personal wallets surged to 158,000 incidents, affecting at least 80,000 individual victims—triple the number recorded in 2022.

One of the largest losses occurred in December when a victim sent $50 million to a fraudulent wallet mimicking a legitimate address, while $27.3 million was stolen from multi-signature wallets due to private key leaks.

Rising Personal Security Risks Across Platforms

Recently, Ubuntu developer Alan Pope reported that attackers are hijacking Snap Store publisher accounts by registering expired domains linked to legitimate developers, then deploying malicious updates to previously trusted packages.

This tactic leverages automatic update systems and established trust signals, with at least two confirmed cases of wallet-stealing malware being distributed through seemingly benign applications.

As these various attack vectors continue to grow, Better Business Bureau officials are alerting consumers to phishing campaigns that lock X users out of their accounts, subsequently exploiting them for cryptocurrency promotions.

Kentucky journalist Jennie Rees recounted instances of receiving direct messages from individuals she believed to be colleagues requesting her vote for contests, only to discover her account was posting fraudulent claims of Audi purchases linked to crypto earnings after clicking a malicious link.