SpaceX Starlink X Account Compromised in Crypto Scam

Key Takeaways

• The official X accounts for SpaceX and Starlink were compromised, briefly promoting a fraudulent cryptocurrency.
• The scam involved a “rug pull,” leaving investors with worthless tokens after purchasing the promoted coin.
• The compromise leveraged the accounts’ large follower base and verification status to lend legitimacy to the scam.
• This incident follows a pattern of high-profile X account compromises used for crypto fraud.

SpaceX and Starlink X Accounts Compromised in Crypto Rug Pull Scam

The official X accounts for SpaceX and its satellite internet service, Starlink, were reportedly compromised, leading to the promotion of a cryptocurrency scam. The fraudulent activity culminated in a “rug pull,” where the creators of the digital asset abruptly withdrew liquidity, rendering the token worthless for unsuspecting investors.

Anatomy of the Compromise and Scam

Reports from various online sources indicate the incident began with a user account named “Sam Catman,” which falsely claimed association with SpaceX’s artificial intelligence initiatives. This account posted promotional material for a new cryptocurrency coin.

Crucially, the official SpaceX and Starlink X accounts then amplified this fraudulent content by reposting it. This action provided a veneer of legitimacy to the scam, leveraging the immense, verified follower bases of both accounts. Screenshots circulating online show these malicious reposts interspersed with genuine updates from SpaceX, such as those concerning its Grok AI model, suggesting the fraudulent content was seamlessly integrated into the accounts’ regular activity rather than being part of an obvious, overt takeover.

The “Rug Pull” and Investor Losses

Consistent with typical cryptocurrency pump-and-dump schemes, investors who acquired the promoted token soon became victims of a “rug pull.” This predatory tactic involves scammers draining the liquidity pool of a cryptocurrency once a sufficient number of investors have purchased the asset. This leaves token holders with an asset that cannot be traded and no practical means of recovering their funds. Given that control over the underlying smart contract often rests solely with the coin’s creator, victims typically find themselves unable to reverse transactions or trace their losses through standard exchange mechanisms.

A Recurring Pattern of High-Profile Account Compromises

This incident is not an isolated occurrence. High-profile and official X accounts have frequently been targeted and exploited to promote fraudulent cryptocurrency schemes. Notable past examples include the U.S. SEC’s account, which falsely announced Bitcoin ETF approval in January 2024, and the compromise of BBC presenter Nick Robinson’s account earlier this year to promote a fake Solana token named “$Today.”

SpaceX itself has been a brand repeatedly exploited in crypto scams for years. A significant campaign in 2021 utilized fake SpaceX coin promotions on YouTube, siphoning approximately $1 million from investors before a similar liquidity pull occurred.

Attackers consistently target large, trusted brand accounts due to their immediate reach to millions of followers. The presence of X’s verification checkmark or affiliate badge further cultivates a false sense of authenticity, effectively lowering victims’ guard.

Previous incidents suggest common compromise vectors, including phishing emails designed to mimic platform policy notices and unauthorized access to phone numbers linked to account recovery, rather than sophisticated technical exploits against the platform itself.

As of this reporting, neither SpaceX nor X has released an official public statement confirming the full scope of the compromise or the measures taken for its resolution. Details continue to emerge primarily from user reports and observations.

What You Should Do

• Exercise extreme caution with any cryptocurrency promotions, even those from seemingly official or verified accounts.
• Always verify claims through multiple official channels (e.g., company websites, official press releases) before acting on investment advice.
• Be suspicious of unsolicited investment opportunities, especially those promising unusually high returns.
• Enable multi-factor authentication (MFA) on all social media accounts, particularly those with high visibility, using an authenticator app rather than SMS where possible.
• Regularly review account security settings and linked devices for any unauthorized access.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.