<\/p>\n
The whole operation took less than an hour, and the most valuable thing the attacker stole was not money. It was credibility. On Sunday, July 12, the verified X accounts of SpaceX and Starlink, with two million and 1.6 million followers between them, reposted promotional content for a memecoin called SCATMAN. <\/p>\n
<\/p>\n
The repost sat in the normal flow of the accounts\u2019 output, alongside routine posts about Grok model updates, with no defacement, no changed banner, none of the usual tells of a takeover. It simply looked like SpaceX had something to say about a token.Buyers responded the way buyers respond. In the first twenty minutes the token rose 575%. By the time the posts came down on Sunday evening and the accounts were restored, the attacker had minted ten trillion SCATMAN, sold the supply across two wallets for roughly 73.7 ether, and walked away with about $135,000. Everyone who bought on the strength of a SpaceX repost held a worthless token.<\/p>\n
The dollar figure is almost embarrassing. A hundred and thirty five thousand dollars is a rounding error next to the eight figure hacks that define crypto\u2019s security discourse, and it is nothing at all next to the $1.16 billion in bitcoin sitting on SpaceX\u2019s own balance sheet. That gap between the scale of the brand exploited and the size of the payday is the actual story, and it points at something the industry has not solved: the cheapest attack surface in crypto is not a smart contract or a bridge. It is a login.<\/p>\n
Every serious defense crypto has built assumes the attacker must beat cryptography, economics, or code. The July 12 attacker beat none of those. They beat a password, borrowed a decade of accumulated public trust for roughly forty minutes, and converted it directly into ether at the expense of anyone who believed what a verified account told them.<\/p>\n SpaceXAI and Starlink X accounts got hacked.<\/p>\n They pumped SCATMAN to $2M MC.<\/p>\n Then it crashed 98%.<\/p>\n Hackers made $135k.<\/p>\n I made $0 because I didn’t buy.<\/p>\n But I respect the play. Degens gonna degen. \ud83e\udd21<\/p>\n \u2014 Crypto.Anu\ud83d\udc0d (@CryptoAnu_) July 14, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n The sequence, reconstructed from onchain analytics and screenshots circulated before the posts were deleted, is short enough to fit in a paragraph and repeatable enough to fit in a playbook.An account calling itself Sam Catman appeared, displaying an affiliation badge that falsely tied it to SpaceX\u2019s artificial intelligence work. The name was a pun on Sam Altman, timed to the ongoing public feud between Elon Musk and the OpenAI chief executive, a feud that had produced a $150 billion lawsuit and had Musk himself posting about scamming the day before the breach. The joke did work that the token itself could not: it made the promotion feel like something SpaceX might plausibly amplify. Musk\u2019s companies post irreverently. A crude swipe at a rival chief executive, delivered as a memecoin, sits within the observed behavior of the brand, and that plausibility was engineered rather than lucky.<\/p>\n The SCATMAN token was deployed on Robinhood Chain, the trading platform\u2019s layer 2 network that had gone live eleven days earlier and permits anyone to deploy a token without approval. The SpaceX and Starlink accounts then reposted the Sam Catman promotion, complete with the contract address and ticker.<\/p>\n Trading exploded. Reported peak market capitalization varies sharply by source and by measurement window, from roughly $800,000 in the first twenty minutes to $2 million on some trackers to $32 million at the high water mark reported by onchain analysts, with twenty four hour volume around $5.7 million. The spread itself tells you something about the quality of the market: on a token this thin, market capitalization is a number generated by the last trade, not a measure of anything real.The attacker sold. Onchain analytics firm Lookonchain traced ten trillion tokens dumped for 59 ether, worth about $108,000, from one wallet, and a further 59.28 million tokens sold for 14.7 ether, about $27,000, from a second wallet controlled by the same actor. Liquidity drained. The price collapsed. The posts were removed, the Sam Catman account was suspended, and control of the SpaceX and Starlink handles was restored the same evening.<\/p>\n As of publication, neither SpaceX nor X has explained how the accounts were compromised. Robinhood has not commented on its chain hosting the token. Every figure in the paragraphs above comes from third party onchain analysis, not from any company disclosure, which is itself worth noticing: the only institution that produced a public account of what happened was the blockchain.<\/p>\n This doesn\u2019t even make sense!<\/p>\n Spacex and startlink official X account got hacked and used to promote a scam token!?!? <\/p>\n Mind you these companies belong to the owner of X which is obv @elonmusk<\/a> <\/p>\n So how are X accounts owned by the owner of X this easy to hack?\ud83e\udd28 https:\/\/t.co\/TWzwZ08Idp<\/a><\/p>\n \u2014 Blockchain Bob (@blockchainbob) July 13, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n <\/p>\n Strip away the specifics and the attack has one moving part. Attackers are not building audiences. They are borrowing them, for the length of a single post, and converting borrowed trust into ether before the loan comes due.The economics are brutal in their simplicity. A memecoin launched by an anonymous wallet reaches nobody. The same token, reposted by an account with two million followers that has spent a decade earning the right to be believed, reaches a market instantly. The attacker does not need the trust to last. They need it to survive for the length of a candle.<\/p>\n This is why the payday size is misleading as a measure of severity. The constraint on the attacker\u2019s profit was not the audience or the credibility. Those were enormous. The constraint was market depth: there simply were not enough buyers with enough capital in the pool to absorb ten trillion tokens at a higher price. The attacker extracted essentially all the liquidity that existed. On a deeper chain, or with a slower response from Musk\u2019s security team, the same attack with the same inputs produces a much larger number. The record supports that reading. When attackers seized the dormant account of Keith Gill, better known as Roaring Kitty, in May, they launched a token on Solana and cleared more than $600,000 in half an hour. When the Pump.fun account was compromised in February 2025, one wallet made over $135,000 in under a minute. A hijacked account belonging to former Malaysian prime minister Mahathir Mohamad produced $1.7 million in losses.<\/p>\n The pattern list is long and its membership is indiscriminate. The United States Securities and Exchange Commission\u2019s own account announced a fake bitcoin ETF approval in January 2024, moving the entire market. Scroll co-founder Ye Chen\u2019s account was taken over in January 2026. Pepe creator Matt Furie\u2019s account pushed a scam token months later. World Liberty Financial co-founder Zach Witkoff, the leader of Myanmar\u2019s junta, and a BBC presenter have all been used as unwitting distribution. What unites them is not an industry, a chain, or a security posture. It is a follower count.<\/p>\n The defense industry has no product for this. There is no audit that certifies a chief executive\u2019s password manager. There is no bug bounty covering a social media platform\u2019s session token handling. The security spend that protects a protocol treasury, multisig thresholds, hardware wallets, timelocks, all of it terminates at the edge of the chain, and the attack originates one layer above, in a consumer product operated by a company with no stake in crypto\u2019s outcomes. The industry has outsourced its most important trust primitive to a social network and has no contractual relationship with it whatsoever.<\/p>\n Crypto has spent years building defenses against a different threat model. Audits check contract code. Bug bounties surface protocol flaws. Formal verification proves that a program does what its specification says. Timelocks and multisigs guard treasuries, a lesson the industry learned expensively when a single vote drained a DAO, which crypto.news examined in its explainer on what a governance attack is. All of that machinery assumes the attack comes through the chain.<\/p>\n The SCATMAN attack came through a social media account. There was no contract to audit, because the contract did exactly what it was written to do. There was no protocol to exploit, because no protocol was exploited. Robinhood Chain worked as designed: it let someone deploy a token permissionlessly, and it let that token trade. Every component behaved correctly, and buyers still lost their money, because the failure happened in the layer nobody in crypto controls and everybody depends on, the layer where reputation is stored.<\/p>\n Consider what a diligent buyer could actually have done in the twenty minute window. Check the contract? It was a standard token; the exploit was the promotion, not the code. Check holder concentration? The attacker held everything, which describes most tokens in their first minutes and is not by itself proof of fraud. Check the liquidity lock? There was liquidity, briefly. Check the source? The source was SpaceX. That was the whole point.<\/p>\n The honest conclusion is that the standard retail checklist offers close to zero protection against this specific attack, because the checklist assumes the promotion is the least trustworthy input and the chain data is the most trustworthy. Here the chain data looked ordinary and the promotion looked impeccable. The only defense that works is a rule rather than an inspection: no verified account\u2019s post, from any brand, is a reason to buy a token minted minutes earlier. That rule costs its holder every genuine celebrity token launch, which is a price most people should be delighted to pay.<\/p>\n The venue is not incidental. SCATMAN landed on a chain in its second week of life, and the chain\u2019s condition shaped the outcome.Robinhood Chain launched on July 1 as a permissionless layer 2 aimed at onchain finance and real world asset tokenization. What arrived instead, at least first, was memecoins: more than 75% of trading volume in the opening week, with the network\u2019s memecoin market capitalization briefly topping $244 million, more than $3 billion in cumulative decentralized exchange volume, and 19,586 new tokens created in a single day by July 13, second only to Solana. Cross chain interoperability provider Relay Protocol publicly warned about honeypot tokens proliferating on the network, coins hardcoded so buyers cannot sell or whose transfers route funds to an attacker, and said it was blocking them as they appeared.<\/p>\n That is the environment SCATMAN exploited: a young chain with real retail attention, minimal mature tooling, and an inflow of tokens far exceeding anyone\u2019s ability to screen them. It is not a Robinhood specific failure. It is what permissionless launch infrastructure looks like at week two, and Solana\u2019s own history through the rise of memecoin launchpads documents the same arc. The difference is the brand on the door. A chain carrying the name of a mainstream retail brokerage, whose users skew toward people who have never evaluated a token contract in their lives, inherits a duty of care that a purely crypto native chain never had, and the network\u2019s design offers no obvious way to discharge it.<\/p>\n Robinhood\u2019s silence on the incident is therefore the most interesting non-event of the week. The company did not deploy the token, did not promote it, and cannot in any technical sense prevent the next one. It also cannot escape the fact that a scam bearing SpaceX\u2019s stolen credibility used its chain to reach its users. The gap between what a chain operator controls and what a chain operator is blamed for is about to become a live commercial question, not a philosophical one.<\/p>\n spacex and starlink accounts got hacked yesterday<\/p>\n the hackers used them to promote a memecoin called “scatman”<\/p>\n people trusted the accounts and started buying<\/p>\n the coin reached around $2m mcap before the scammers dumped everything and disappeared<\/p>\n they made around $130k<\/p>\n and one\u2026 pic.twitter.com\/jtM4IqOlWv<\/a><\/p>\n \u2014 Evo (@EvoOnChain) July 13, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n <\/p>\n There was one genuine signal available in real time, and almost nobody could use it.The Sam Catman account was new. Its affiliation badge, the marker that ties an account to a parent organization on the platform, was fraudulent, claiming a link to SpaceX\u2019s artificial intelligence work that did not exist. Someone who knew how badge inheritance works, who checked the account\u2019s age, and who understood that a legitimate SpaceX subsidiary would not announce itself through a pun account, could have identified the fraud before buying.<\/p>\n That describes a vanishingly small population, and it describes them under conditions that made the knowledge useless. The window was twenty minutes. The signal required domain expertise in social media platform mechanics, not crypto. And the accounts amplifying the fraud were the exact accounts a user would check to verify it. The verification path led straight back to the attack.<\/p>\n This is what makes brand token crime structurally different from the failure modes retail has been trained on. A rug pull on a random token asks a buyer to evaluate a stranger and get it wrong. A hijacked account asks a buyer to evaluate an institution and get it right, then punishes them for the institution\u2019s operational security failure. The buyer\u2019s diligence was not insufficient. It was aimed at the wrong entity, because the entity that failed was never one they could inspect. The generic advice to check holder distribution and creator history, sound guidance across the meme coins landscape, simply does not reach a case where the creator\u2019s history is a forged badge and the distribution looked normal for sixty seconds.<\/p>\n There is a serious argument that the industry should be relaxed about all of this, and it deserves a fair hearing.Start with the numbers. The total damage was $135,000, spread across an unknown number of buyers who chose to purchase a token named after a joke about a lawsuit, minted an hour earlier, on a chain eleven days old. Compare that to the $11 billion in crypto related losses the FBI\u2019s Internet Crime Complaint Center reported in 2025, or the industrial scale of romance and investment fraud operations. Account takeover memecoin scams are, in aggregate, a rounding error against the frauds that destroy people\u2019s lives.<\/p>\n Continue with responsibility. Nobody was tricked into revealing a private key. No wallet was drained. Buyers made a voluntary purchase of a speculative asset in an unregulated market on the basis of a social media post, which is a decision the market is entitled to price. The permissionless systems performed exactly as advertised: anyone can create a token, anyone can buy it, nobody is protected. That is the deal, and it is disclosed in every interface.<\/p>\n Add that the response worked. The accounts were recovered within hours. The posts were deleted. The fake account was suspended. Lookonchain published both wallet addresses, meaning the proceeds are now permanently marked and traceable, an outcome that traditional financial fraud rarely delivers. Exchanges can flag those addresses. Investigators have a starting point. Compare the transparency of that aftermath to a wire fraud of equivalent size, where the money simply disappears into correspondent banking. Upbit\u2019s freeze of proceeds after a recent onchain treasury attack shows that marked funds are not merely symbolic, and exchanges do act on published addresses when the trail is clean enough.<\/p>\n Finish with proportion. The attack is self limiting. Its profit is capped by the depth of the pool it dumps into, and thin pools are thin precisely because the market has correctly assessed these tokens as worthless. The scam succeeds only against buyers who ignore every rule the industry has spent a decade writing down.None of that is wrong. It is also, taken together, an argument for doing nothing, which is why the counterargument matters more.<\/p>\n <\/p>\n The dismissive reading treats $135,000 as the measure of the harm. It is the measure of the attacker\u2019s revenue, which is a different quantity entirely.The harm is the erosion of the only verification mechanism retail actually uses. Ordinary people do not read contracts. They read who is saying it. That heuristic, trust the verified account of a company that builds rockets, is the single most reliable signal available to a non technical person on the internet, and each successful hijacking teaches the market that the signal is unreliable. A world in which no institutional account can be believed is a world in which every genuine announcement, every legitimate product launch, every real partnership arrives pre-discounted. The industry is spending down a shared reputational asset it did not build and cannot replenish, one $135,000 withdrawal at a time.<\/p>\n Then consider the trajectory. This attack costs almost nothing to attempt, carries low apparent consequence, and produces a payday in minutes. The rate of attempts is a function of expected value, and expected value is rising as more mainstream brands acquire crypto surfaces. SpaceX now holds 18,712 bitcoin and trades as a Nasdaq-100 component whose price is discovered partly on crypto rails, a structural reality crypto.news examined when the stock joined the index. Every corporate account with a crypto adjacent story is now a live financial instrument, whether the company knows it or not, and the compromise of such an account is no longer a public relations incident. It is a market event.<\/p>\n Notice too what the attacker actually needed: no capital, no code, no confederates, and roughly one hour. Meanwhile, the defenders needed exactly what they did not have, which is a way to un-say something to millions of people faster than a bot can buy. Deletion is not a remedy when the trade has already cleared. The asymmetry is total: the attack executes at the speed of a repost, and the correction executes at the speed of a corporate security team noticing, escalating, and regaining access. In the interval, an irreversible ledger records everything.<\/p>\n And the regulatory exposure is asymmetric in an ugly way. Attackers face weak enforcement against pseudonymous wallets. The chains, the brokerages, and the exchanges hosting the activity face regulators who are actively deciding, this month, how much responsibility infrastructure operators bear for what runs on top of them. Every SCATMAN is evidence in that proceeding, and it is evidence that arrives conveniently packaged: a household brand, a retail brokerage\u2019s chain, an unsophisticated victim class, and a perpetrator who will probably never be identified. The industry\u2019s argument for permissionless infrastructure gets harder to make each time permissionless infrastructure is the medium through which a stolen brand robs retail buyers, and the regulatory window in which those arguments are being weighed is measured in weeks, not years.<\/p>\n Markets don’t evolve one product at a time. They evolve when the underlying infrastructure changes.<\/p>\n\n
What happened, in order<\/strong><\/h2>\n
\n
Credibility arbitrage is the business model<\/strong><\/h2>\n
Why the defenses that exist do not cover this<\/strong><\/h2>\n
The Robinhood Chain problem<\/strong><\/h2>\n
\n
The tell that was there, and why it did not help<\/strong><\/h2>\n
The case that this does not matter much<\/strong><\/h2>\n
The case that it matters a great deal<\/strong><\/h2>\n
\n