Hacked Project Social Accounts: How to Avoid Fake Announcements

When a crypto project's social media account is hacked, attackers use it to post fake announcements, usually a surprise airdrop, mint or token migration, that send followers to a wallet-draining website. The best protection is simple: never act on a single post; confirm any announcement involving your wallet on at least one other official channel, such as the project's website or documentation.

These attacks are effective because they borrow real trust. The account is genuine, the badge is genuine and the followers are genuine. Only the post is fake, and attackers know they only need a short window before the team regains control.

How Account Takeovers Happen

Attackers rarely "hack" the platform itself. They target people and connected services:

• Phishing team members. Fake messages claiming a copyright strike, verification problem or partnership offer lead staff to log in on a fake page.
• SIM swaps. If an account relies on text-message codes, an attacker who takes over the phone number can reset the password. See our guide to SIM swap attacks.
• Compromised third-party tools. Scheduling or analytics apps with posting permission can become a back door.
• Weak or reused passwords. A password leaked from another site can unlock the account.
• Insiders or former contractors who kept access after leaving.

Discord and Telegram servers face similar risks through compromised moderator accounts or malicious bots that post in announcement channels.

How the Scam Unfolds, Step by Step

1. 1Takeover. The attacker gains access and often changes the recovery email and phone number to lock out the team.
2. 2Preparation. They set up a convincing site on a look-alike domain, usually wired to a wallet drainer.
3. 3The post. A fake announcement appears: "Surprise airdrop for holders," "Our token is migrating; swap now," or "Limited free mint, 30 minutes only."
4. 4Amplification. Replies are restricted to stop warnings, the post may be pinned, and other compromised or bot accounts reshare it.
5. 5The drain. Victims connect wallets and sign approvals or transactions that hand over their assets. Our explainer on wallet drainers shows how these contracts work.
6. 6Cleanup. The team regains access hours later, deletes the posts and warns users, but signed transactions cannot be reversed.

A Hypothetical Example

This scenario is a composite for illustration, not a real case. Imagine a mid-sized DeFi project with a well-known account. On a Sunday evening, it posts: "To celebrate our anniversary, all holders can claim a bonus. Claim closes in two hours," with a link to a domain one letter different from the official one. Replies are limited. We cover this in more detail in How to Find a Crypto Project's Official Social Accounts.

Many followers click. The site asks them to connect a wallet and sign a "claim" request. In reality, the signature grants a drainer permission to move their tokens. Two hours later, the project's other channels post a warning that the account was compromised. By then, the damage is done. See also: Crypto Social Apps and Farcaster-Style Networks Explained.

The giveaways: an unannounced reward, a short deadline, a slightly wrong domain, limited replies and no matching post on the project's website. Related reading: Fake Crypto Trading Courses and Gurus.

Warning Signs Checklist

How to Verify an Announcement

1. 1Check the official website. Does the site's news page, blog or banner mention it? Type the address yourself; do not follow the link in the post.
2. 2Check other official channels. Look at the project's documentation, other social accounts or official forum. Teams usually post a warning there quickly when an account is compromised.
3. 3Compare the domain. Make sure the link matches the domain listed in the official docs, character by character. Our guide on how to verify a website is the official project site has a step-by-step method.
4. 4Wait. Real claims and migrations rarely require action within minutes. Waiting an hour costs little; rushing can cost everything.
5. 5Look for signed messages. Some projects publish cryptographically signed statements. Read how to verify a signed message from a project.

How to Protect Yourself Over Time

• Bookmark official sites and apps and use only those bookmarks.
• Use a separate "burner" wallet with small balances for claims and mints.
• Turn on transaction simulation or clear-signing features if your wallet offers them.
• Revoke unused approvals regularly.
• Follow projects on more than one channel so you can cross-check quickly.

What to Do If You Fell for It

• Visited the site only: close it and do not download anything it offered.
• Connected and signed: revoke approvals and move assets to a safe wallet.
• Entered your seed phrase: create a new wallet and transfer remaining funds immediately.

Our guide on what to do immediately if your wallet is compromised walks through each step. Save the post, link and transaction hashes, and report the fake site through our scam report form. For next steps with platforms and authorities, read how to report a crypto scam and what happens next.

Bottom line

A hacked crypto Twitter account looks exactly like the real thing because it is the real thing, temporarily in the wrong hands. Treat any post that asks you to connect a wallet as unverified until you confirm it on the official website or another official channel. A few minutes of checking stops the most common way these takeovers turn into losses.