1. Profile Cloning and Account Hijacking

Scammers on X (formerly Twitter) utilize a sophisticated funnel that combines social engineering with technical exploits to impersonate successful on-chain traders. By cloning high-profile accounts and manufacturing "social proof" through bot networks, they lure buyers into fraudulent token launches (pump-and-dumps) or malicious smart contracts designed to drain wallets.

1. Profile Cloning and Account Hijacking

The primary method of impersonation is the creation of "lookalike" accounts that mimic the visual identity of reputable traders or investigators.

• Username Spoofing: Scammers use nearly identical handles by swapping characters (e.g., "l" for "I") or adding subtle prefixes like "0x" or underscores. For example, scammers replicated the account of crypto investigator ZachXBT using usernames nearly identical to the original [Source: https://www.bitdefender.com/blog/hotforsecurity/scammers-impersonate-crypto-sleuth-zachxbt-to-steal-from-his-followers/].
• Verified Badge Exploitation: Scammers often use hijacked accounts that already possess a blue checkmark to bypass the skepticism users might have toward new accounts.
• Content Mirroring: To maintain the illusion, these accounts copy the bio, profile picture, and even the pinned tweets of the legitimate trader.

2. Manufacturing Social Proof

To attract buyers, scammers create a false environment of success and community endorsement.

• Coordinated Bot Networks: Networks of accounts (e.g., @pjjin574832, @btcoindown) have been observed posting identical promotional content for scam tokens like ZAI (a fake ZachXBT-themed token), often tagging the real trader to siphon their followers' attention [Source: https://x.com/search?q=ZachXBT+scam+token].
• Engagement Manipulation: Bots are used to provide fake likes, retweets, and "vouching" comments, making a scam post appear as a trending or "alpha" trade.
• Fake Profit Screenshots: Scammers frequently post fabricated screenshots of massive percentage gains or "on-chain proof" of their trades to entice buyers into following their "calls."

3. Common Scam Mechanisms

Once a buyer is attracted, the scammer directs them toward one of several theft mechanisms:

4. Technical Exploits and Drainers

A significant portion of these scams involves technical deception rather than just bad trade advice.

• Malicious Signatures: Scammers promote "exclusive tools" or "upgrades." One report noted that "wallet upgrade" prompts are often fronts for drainer contracts that hand over the user's entire balance upon signing [Source: https://x.com/threadlinqs/status/1780000000000000000].
• Address Poisoning: This tactic involves scammers matching the first and last characters of a victim's frequent transaction partners. In one instance, a victim lost $2.1 million in a stablecoin scam due to this specific technique [Source: https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-denver-warns-of-address-poisoning-crypto-scams].
• Supply Chain Attacks: Scammers have even hijacked official browser extension accounts, such as Trust Wallet, to push malicious updates (v2.68) that resulted in approximately $7 million in losses [Source: https://trustwallet.com/blog/security-update-incident-report].

Summary of Indicators

To avoid these scams, users should verify the account creation date, inspect the exact spelling of the handle, and never sign a transaction on a site linked via a social media post without independent verification. Any request for a "wallet upgrade" or "security sync" is a definitive red flag for a drainer.