OAK — OnChain Attack Knowledge

Worked example · 2026-03

Panic-Account Farm — $0 Direct Loss / Scam Traffic Funnel via Doomposting — 2026-03

Loss
No direct loss figure — the operation manufactured viral panic to drive traffic → crypto scams (fake giveaways, phishing links). 10+ coordinated accounts with purchased followers posting doom content multiple times per day.
OAK Techniques observed
none — a coordinated inauthentic account network as a phishing distribution surface has no Technique at v0.x. T4.007 is the nearest neighbour, but its load-bearing property is that the attacker's spend is denominated in the platform's native asset and converts directly into visibility; here the spend is off-platform account purchase and the visibility is farmed organically — adjacent, not the same primitive. T15.006 does not hold either: the accounts were purchased rather than compromised, and the operators post as fabricated personas rather than exploiting a verification signal on a real brand. No on-chain artefact, no named extraction primitive, and $0 direct loss are established. Candidate gap, which the file argues itself: coordinated inauthentic account network as scam infrastructure.
Attribution
pseudonymous — 10+ account network identified. Individual operators not publicly named. ZachXBT investigation published March 2026.
Key teaching point
The panic-account farm demonstrates the manufactured-reality-to-scam-funnel pattern: the operators purchased X/Twitter accounts with existing followers, used them to post doom-content about war and politics to generate viral engagement, reposted content from alt accounts to create the illusion of multiple independent voices, and then — once the panic content had generated traffic — promoted fake giveaways and scam links. The doom-content is the traffic engine; the scams are the monetization. Detection approach: cross-reference accounts that alternate between high-engagement doom/panic content and crypto scam promotion; the content transition from "WW3 imminent" to "claim your airdrop" is the detection signal.

Summary

In March 2026, ZachXBT uncovered a coordinated network of 10+ X/Twitter accounts manufacturing viral panic about war and politics as a traffic engine for crypto scams.

The operation:

  1. Purchase accounts with followers: Acquire existing X accounts that already have follower counts (bypassing the need to build audience from scratch).
  2. Doompost multiple times per day: Post alarming content about war, politics, and global catastrophe — content that generates high engagement (retweets, quote tweets, replies) because fear is the most shareable emotion.
  3. Repost from alt accounts: Each account reposts content from the other accounts in the network, creating the illusion of multiple independent voices all saying the same thing. This is a synthetic consensus.
  4. Monetize the traffic → crypto scams: Once a post goes viral, edit it or reply to it with a fake crypto giveaway, phishing link, or scam token promotion. The viral reach of the doompost is now channeled to the scam.

The doom-content and the crypto scams appear disconnected to casual observation — the operational connection is only visible by tracing the account network and observing the content transition pattern.

Timeline

When Event OAK ref
Pre-Mar 2026 10+ accounts with purchased followers begin coordinated doomposting T4 coordinated inauthentic behavior
2026-03 (ongoing) Viral posts monetized via fake giveaways and scam links T2 scam monetization
2026-03-23 ZachXBT publishes investigation uncovering the network (public disclosure)

What defenders observed

  • Doom-content as the traffic engine. War and political panic generate the highest engagement rates on social media. The operators chose doom-content not because they care about politics — but because fear is the optimal content strategy for reach. The content strategy is purely instrumental.
  • Alt-account repost network as synthetic consensus. When 10 accounts all post similar doom-content and repost each other, a user scrolling sees multiple "independent" voices confirming the same narrative. The network creates a false reality — the user doesn't know all 10 accounts are controlled by the same operators.
  • Content transition as the detection signal. The same account that posts "World War 3 is starting" at 9 AM posts a crypto scam link at 2 PM. The transition from doom-content to financial scam is the behavioral fingerprint that distinguishes a scam account from a genuine political commentator.
  • Purchased accounts = pre-existing trust. Buying accounts with existing followers bypasses the trust-building phase. The followers already trust the account (from its previous, legitimate content), making the pivot to scam promotion more effective.

What this example tells contributors

  • Coordinated inauthentic behavior (CIB) as scam infrastructure is a T4 sub-type. The 10-account network is infrastructure, not a single scammer. The capital investment (purchasing accounts) and content strategy (doomposting) are operationalized. T4 should include "coordinated inauthentic account network" as a sub-pattern — the detection surface is the inter-account repost graph, not individual account content.
  • Content pivot detection: doom → crypto scam. An account that switches from political doomposting to crypto promotion is a high-precision scam signal. This is detectable through content topic modeling — when an account's topic distribution shifts from "politics/war" to "crypto/scam" within a short time window, flag it.
  • Synthetic consensus is detectable through repost graph analysis. When N accounts exclusively repost each other and share the same content themes, they form a clique in the repost graph. Clique detection on the account-repost graph identifies coordinated networks before they pivot to scams.

Public references