Hijacked accounts: when a trusted voice posts a scam

The post comes from an account you've followed for years — a well-known project, a founder, a respected analyst. It announces a surprise token launch, a limited airdrop or an urgent migration, with a link. The account is verified, the profile picture is right, the writing style even sounds familiar.

And it's a scam, because the account isn't in its owner's hands any more. Account takeovers on social media have become one of the most efficient ways to steal crypto, precisely because they borrow trust that took years to build.

Why attackers want trusted accounts

A fake account has to earn attention from zero. A hijacked one starts with an audience that already believes it. One post from a compromised project account can reach hundreds of thousands of followers in minutes, and attackers only need a small fraction of them to click before the post is noticed and removed.

That's also why these attacks are usually fast and loud: a burst of posts, replies switched off or flooded with fake praise, and a link that only needs to work for an hour.

How accounts get taken over

• Phished logins. Fake "copyright violation", "verification" or "partnership" messages lead to lookalike login pages that capture the password and the two-factor code in real time.
• SIM swaps. If the account's recovery relies on a phone number, an attacker who ports that number to their own SIM can reset the password.
• Compromised connected apps. A third-party scheduling or analytics tool with posting rights can be abused without touching the password at all.
• Malware on a team member's device stealing logged-in sessions — no password needed.
• Weak recovery email. The social account is strong, but the email behind it isn't.

What the scam post usually says

• A surprise token or airdrop with a "claim" link — the same pattern as fake airdrops: connect your wallet, sign, lose your funds.
• An urgent migration — "move your tokens to the new contract before the deadline".
• A security warning that's itself the attack — "a vulnerability was found, revoke and re-approve here".
• A giveaway that asks you to send funds first.
• A support offer — a reply from a "team" account offering to help with your issue, which leads to the same fake-support playbook.

How to spot it

• Urgency plus a link from any account is a warning, however trusted the account.
• Check other channels. Is the same announcement on the project's website, documentation, blog and other official accounts? Real launches are coordinated; hijacks usually aren't.
• Look at the link's domain, not the text. A new or slightly different domain is the clearest signal.
• Notice when replies are disabled or full of identical enthusiastic comments.
• Wait an hour. Hijacks are usually spotted and reversed quickly. A real opportunity will still be there; a scam usually won't.

The rule underneath all of these is the one from phishing generally: don't act on links from messages — go to the site yourself.

If you run an account people trust

Projects and public figures are targets precisely because of their audience. A few measures make a takeover much harder:

• Use a hardware security key or authenticator app for two-factor authentication, not SMS.
• Remove the phone number as a recovery method where the platform allows it.
• Protect the recovery email with the same standard as the account itself.
• Audit connected apps regularly and remove any you no longer use.
• Limit who can post, and use the platform's team or delegate features rather than shared passwords.
• Pre-agree a takeover response: who contacts the platform, where you post the warning, and how followers can verify official channels.

How SSP communicates

SSP will never announce a token, an airdrop, a "migration" of your funds or a reason to enter your recovery phrase anywhere. There's nothing for us to migrate: your coins sit in your own 2-of-2 vault, and only your two devices can move them.

If you ever see a post from an account that looks like ours asking you to connect, claim, migrate or verify a wallet, treat it as compromised, and check the official website and documentation before doing anything.

And if a link does slip through, SSP's two-device approval gives you a second chance: every transaction and signature needs confirmation on SSP Key, on your phone, where you can read what you're actually approving.

The honest summary

A hijacked account turns someone else's reputation into an attacker's megaphone. The account being real doesn't make the post real.

Treat urgency and links with suspicion whoever posts them, confirm announcements through a second official channel, go to websites yourself instead of clicking, and give any "limited-time" opportunity an hour. Most hijacks don't survive that long.