Hackers are hijacking X accounts of governments and businesses marked with gold and gray checkmarks, including Google's Mandiant, to promote crypto scams
The hijacked account was used to push #cryptocurrency scams. — The “change password please” made me giggle. :ablobcatlurk: — Zoinks. — #security #twitter #birdsite — https://arstechnica.com/... X: @malwrhunterteam : The account of Amina Gerba, a senator in the Canadian Senate got pwned, renamed & being used to spread scam. And as she is a senator, the account has a gray checkmark. 🤷♂️ The actors are using it to fake as the “LFG” project that not even have a blue checkmark on their account. 😂 [image]
Context & Ripple Effects
This is a recurrence of the account-takeover playbook seen in the 2020 hijackings of prominent Twitter accounts for Bitcoin scams, but with gold and gray checkmarks supplying institutional credibility rather than celebrity reach.
It also follows reports of crypto-brand impersonation on X, where scammers used lookalike identities and fake links. Here, control of genuine government and business accounts removes much of the visible impersonation friction.
First-order effects
- Followers of Mandiant, Senator Amina Gerba, and other affected accounts can encounter crypto promotions carrying the authority of a verified institutional identity.
- X’s gold and gray checkmarks become a liability in the affected posts: they can make a renamed account promoting an unrelated project appear more trustworthy.
Second-order effects
- Organizations with high-trust X identities will need to treat social-account recovery and audience warnings as incident-response work, not merely brand management.
- Crypto scammers can shift from creating fake accounts to compromising established ones, raising the value of account access and making visual verification a weaker standalone signal for users.
Third-order effects
- If verified-account takeovers persist, platform verification will increasingly need to be paired with clearer identity-change history and stronger account-security controls to retain its trust function.
- The broader risk is a widening crypto legitimacy gap: institutional signals intended to identify authentic speakers can be repurposed to lower victims’ skepticism when the underlying account is compromised.
The trend: Crypto fraud is moving from impersonating trusted brands to commandeering the trusted distribution channels themselves.