SpaceX Social Media Accounts Compromised in $125K SCATMAN Token Fraud Scheme

TLDR

Table of Contents

Cybercriminals compromised SpaceXAI and Starlink social media profiles on X to advertise a fraudulent cryptocurrency called SCATMAN
The perpetrator created 10 trillion SCATMAN tokens and liquidated them for approximately $125,000 worth of Ethereum
Blockchain analytics firm Lookonchain traced the operation to two separate cryptocurrency wallets
The fraudulent posts were deleted from both social media profiles once the scam was discovered
This incident continues a growing trend of compromised social accounts facilitating rapid cryptocurrency fraud

Cybercriminals gained unauthorized access to the SpaceXAI and Starlink profiles on X, leveraging them to advertise a cryptocurrency token named SCATMAN. The perpetrators successfully extracted approximately $125,000 in Ethereum before the fraudulent content was removed.

Hacker Makes $125K After Hijacking SpaceXAI & Starlink X Accounts
The attacker promoted a fake $SCATMAN token through compromised social media accounts, minted trillions of tokens, and earned about $125,000 by dumping them before the scam was exposed.
Hacker's Wallet Addresses:… pic.twitter.com/YcjxPSRB8S
— Crypto Patel (@CryptoPatel) July 13, 2026

Inside the SCATMAN Cryptocurrency Fraud Operation

Blockchain analytics service Lookonchain detected the fraudulent activity and successfully tracked the stolen cryptocurrency to two distinct digital wallets.

The criminal actor generated 10 trillion SCATMAN tokens from scratch. This entire token supply was subsequently liquidated for 59 Ethereum, equivalent to approximately $108,000.

A separate wallet associated with the identical perpetrator liquidated an additional 59.28 million SCATMAN tokens for 14.7 Ethereum, contributing roughly $27,000 to the overall proceeds.

The combined proceeds from both digital wallets totaled nearly $125,000. Lookonchain disclosed both wallet addresses to the public.

Various screenshots emerged on social platforms depicting the SpaceXAI and Starlink profiles seemingly resharing material from the SCATMAN account. BeInCrypto was unable to independently confirm these allegations.

When news of the incident emerged, the suspicious reposts had already been removed from both profiles. BeInCrypto contacted SpaceX for an official statement but received no response prior to publication.

The Growing Problem of Social Media Account Compromise

This incident represents part of a disturbing pattern. Compromised social media profiles have emerged as a preferred method for executing rapid cryptocurrency scams.

Fraudsters deliberately target profiles with substantial follower counts because the inherited trust factor generates immediate purchases before investors discover the token’s fraudulent nature.

During February 2025, cybercriminals seized control of Pump.fun’s X profile to advertise a counterfeit token labeled PUMP. A single wallet accumulated over $135,000 in less than sixty seconds.

Former Malaysian Prime Minister Mahathir Mohamad’s profile was similarly compromised to advertise a fraudulent token. That particular operation generated $1.7 million in investor losses.

Myanmar’s military leadership representative and World Liberty Financial co-founder Zach Witkoff experienced comparable attacks during the same period.

The operational methodology remains remarkably consistent. A credible account undergoes compromise, a token launches rapidly, and the perpetrator liquidates holdings before the legitimate account holder regains access.

The SpaceXAI and Starlink profiles possess significant brand recognition connected to Elon Musk, positioning them as premium targets for this fraud methodology.

The SCATMAN fraud operation concluded swiftly, with the perpetrator’s cryptocurrency wallets now publicly documented by Lookonchain.

At publication time, neither SpaceX nor Starlink had issued any official communication regarding the security breach.