Social media account takeovers are a growing threat in crypto. Hackers compromise influential accounts — or create convincing fakes — to promote malicious links to thousands of followers.
How Account Takeovers Happen
Twitter/X Account Takeover
| Method | How It Works |
|---|---|
| SIM swap | Attacker takes over phone number, resets Twitter password |
| Phishing email | Fake “Twitter support” email tricking you into revealing password |
| Session cookie theft | Malware or malicious browser extension steals login session |
| Third-party app | Malicious app with excessive Twitter permissions |
| Insider access | Twitter employee or contractor with internal tools |
Discord Server Takeover
| Method | How It Works |
|---|---|
| Staff impersonation | Fake moderator requests admin privileges |
| Webhook abuse | Malicious webhook that drains roles |
| Token theft | Malware stealing Discord login token |
| QR code scam | ”Scan to verify” QR code that grants access |
What Happens After Takeover
Once attackers control a social media account, they:
- Change the display name and profile picture to match a crypto project or influencer
- Delete previous posts to hide the takeover
- Pin a “giveaway” or “NFT mint” tweet with a malicious link
- DM followers with personalised scam messages
- Post from the account to amplify the scam
Notable Examples
| Incident | What Happened |
|---|---|
| Twitter Bitcoin 2020 | 130+ high-profile accounts (Obama, Musk, Gates, Kanye) tweeted a Bitcoin giveaway scam. $100K+ stolen. |
| Discord hacks | Numerous NFT project Discord servers compromised, leading to stolen funds from fake mints |
| Crypto Twitter personalities | Hundreds of crypto influencers SIM-swapped or phished to promote scam tokens |
How to Stay Safe as a User
Before Clicking Any Link
| Check | What to Look For |
|---|---|
| Is the account verified? | Blue checkmark ≠ safe, but no checkmark = higher risk |
| When was the account created? | New accounts are often scams |
| Does the post seem normal? | Unusual posts from an account you follow could mean it’s hacked |
| Where does the link go? | Hover over links to see the actual URL |
| Search for the announcement | Check if the project confirmed it on their website |
In Discord
- Don’t click links in DMs from strangers
- Never scan a QR code to “verify” your wallet
- Legitimate moderators will never DM you first
- Check the #announcements channel on the server, not DMs
How to Protect Your Accounts
| Platform | Protection |
|---|---|
| Twitter/X | 2FA with authenticator app (not SMS), strong password, no third-party apps with write access |
| Discord | 2FA enabled, don’t authorise unknown apps, backup codes saved offline |
| Telegram | 2FA, disable “People Nearby” |
| 2FA, remove unused logged-in devices |
What to Do If Your Account Is Compromised
| Step | Action |
|---|---|
| 1 | Try to regain access immediately via “Forgot password” |
| 2 | Contact the platform’s support |
| 3 | Post from another account warning your followers |
| 4 | Check connected apps and revoke everything |
| 5 | Change passwords on all other accounts that shared the same password |
How to Help If You See a Hacked Account
- Don’t click the link — Even visiting the page can be risky
- Report the account — Use Twitter/X’s “Report” function
- Reply to the scam tweet — Warn others (but don’t click the link)
- DM the account owner — If you know them through another channel
- Post a warning — Tag the person and warn your followers
Bottom Line
Social media scams work because you trust the account posting them. Always verify significant announcements through official websites, not social media alone. Enable 2FA with an authenticator app on all your accounts. And remember: even verified accounts with millions of followers can be hacked to promote scams.
What matters most
Social media scams work because you trust the account posting them. A verified badge, a famous name, or a large following says nothing about whether the person behind it is still in control — operators take over real accounts all the time, then pin a fake giveaway or mint link to thousands of followers at once. The practical takeaway is that social media is a place to start a conversation, not a place to trust a transaction. Before interacting with any significant crypto announcement, verify it on the project’s official website, which you open yourself rather than through a link someone sent you. And remember that a post asking you to act quickly — “limited mint,” “airdrops ending tonight” — exists precisely to stop you checking, so treat urgency as a reason to slow down.
Hardening your own accounts
The same care that protects your wallet should protect the accounts that present your public face, because a compromised account hurts not just you but everyone who follows you. On Twitter, enable two-factor authentication with an authenticator app rather than SMS, use a strong unique password, and avoid authorising third-party applications that request write access. On Discord, turn on 2FA, store your backup codes somewhere offline, never authorise unknown applications, and be highly suspicious of any “scan this QR code to verify your wallet” prompt. On Telegram, use 2FA and disable “People Nearby,” and on Instagram remove logged-in devices you no longer use. Because session cookies and malware are a common route in, keep your browser extensions to the ones you trust, and treat any unexpected “verify your account” email from an official-looking address as a phishing attempt rather than a legitimate request.
What to do if your account is compromised
If you realise your account has been taken over, move through the recovery steps in order. First, try to regain access immediately through the platform’s password recovery flow, then contact the platform’s official support. Post a warning from another account so your followers know not to click anything that was just shared from your profile. Check every connected app and revoke anything you do not recognise, then change your passwords on all other accounts that reused the same one — attackers frequently harvest reused credentials. Time is the enemy here, because every hour the account stays in the wrong hands is another hour of malicious links reaching your audience.
Helping when you spot a hacked account
If you identify an account that has been taken over, you can reduce the damage without risking yourself. Do not click the link — even visiting the page can be risky. Report the account using the platform’s report function, reply to the scam post to warn others without clicking the link, and, through a different channel, message the account owner directly. You can also post your own warning, tagging the person so their followers know to ignore recent posts. A single visible warning can save an entire community, so treat it as a public service rather than a favour.
Common questions
Q: Why is SMS-based 2FA weaker than an authenticator app? A: SMS verification depends on your phone number, and attackers can perform a SIM swap to take that number over and then reset your passwords. An authenticator app ties the login to the app on your device rather than to a number that can be transferred, making the account far harder to seize.
Q: Someone is DMing me claiming to be a moderator or support agent. Should I help them? A: No. Legitimate moderators and support teams will not message you first asking for credentials, permissions, or a wallet verification. On Discord and most platforms, treat any inbound helper as a scam until you confirm their identity through the project’s official channel.
Q: Can I trust a crypto influencer to recommend products? A: Only with caution. Influential, credible accounts are precisely the ones attackers target, and paid promotions can blur the line between opinion and advertising. Whatever an influencer posts, verify the actual contract or website independently rather than taking the recommendation on trust.