An unknown attacker managed to gain control of the X accounts @SpaceXAI (2 million followers) and @Starlink (1.6 million followers). Using the trust of a multi-million audience, the hacker organized an aggressive advertising campaign for the memecoin $SCATMAN. The scheme is classic: an artificial price surge (pump), followed by an instant dump of all accumulated reserves. As a result of the manipulation, the attacker withdrew approximately $125,000 in ether (ETH).
How the attack unfolded
After seizing the pages, the hacker began posting messages on behalf of the character Sam Catman (verified account @SamCatmanRH with a "gold checkmark"). These posts were instantly reposted from the hacked SpaceXAI and Starlink profiles, ensuring tens of thousands of views, likes, and reposts within minutes. The audience perceived this as an official collaboration.
The token was traded in the SCATMAN/WETH pair on Uniswap V2. The chart shows a vertical price spike, followed by a collapse of 98.38% within 24 hours. Key token metrics at the time of recording: liquidity — $3,900, market capitalization — ~$1.4 million, trading volume — $5.7 million with ~45,000 transactions.
Where the money went
The main profit was extracted in two stages. First, 10 trillion SCATMAN was transferred to the hacker's wallet via the rebalance function. Then this entire amount was sold in a single transaction, yielding 59.0856 ETH (~$108,366 at the time). Almost simultaneously, a second controlled wallet sold 59,276,870 SCATMAN, obtaining 14.7296 ETH (~$27,000). Minor transactions for insignificant amounts were also present, but the bulk of the funds were withdrawn through these two operations.
Notably, gas fees for all transactions remained symbolic — less than $0.01 per transaction, indicating a high level of attack preparation. Analysts tracked the movement of funds across wallets: 0xfee50d4ce48f2d05f520ce04c875647e4870a8ba and 0xdd9f6d3e16ebda7f35cb694ceadb50af3eebba89.
My comment: This incident is yet another reminder that even accounts with millions of followers, belonging to giants like SpaceX, are not immune to hacking. For the crypto community, this is a signal: trust in promotional posts, even from verified profiles, should only be given after additional cross-checking. The "pump and dump" scheme remains one of the most effective and dangerous, especially when brands of this scale are used as a mouthpiece.