The ledger shows a predictable pattern: a hijacked account, a freshly minted token, and a liquidity sweep within minutes. On February 11, 2025, an attacker compromised the verified X accounts of SpaceX and Starlink, posting a link to a new meme coin called SCATMAN. Within minutes, the market cap peaked at $2 million before collapsing to zero. The attacker walked away with $135,000. The retail traders who bought during the hype? They held the bag. This is not a story about clever code or advanced exploits. It is a story about the deepest vulnerability in crypto today: the attention market.
### Context: The Anatomy of a Low-Budget Heist The attack followed a script that has become distressingly common in 2025. The attacker first gained access to the official SpaceX and Starlink X accounts—likely through a phishing link, social engineering, or a compromised third-party app. Once inside, they posted a single tweet: “We’re excited to announce SCATMAN, a new meme coin built for the Mars economy. Grab yours now on Robinhood.” The tweet included a contract address for a standard ERC-20 token. Within 12 seconds, automated bots and retail FOMO drove the price up. The attacker, who held 100% of the 10 trillion token supply, proceeded to dump every single token into the liquidity pool. By the time the tweet was deleted, SCATMAN was trading at $0.00000001. The market cap went from $2 million to zero in under two minutes.
This is not a one-off. The same pattern has been observed in recent attacks on Scroll, Pepe, and even the WinRAR official account. In the case of Roaring Kitty’s account, the profit was over $600,000. The attacker in this case only netted $135K, but the return on investment—a few hours of effort and a cheap phishing kit—makes this a scalable business model. The real question is not how the attacker did it, but why the market keeps rewarding this behavior.
### Core Analysis: Order Flow and the Liquidity Time Bomb Let’s walk through the on-chain data that matters. The attacker’s wallet, flagged by Lookonchain, was funded with an initial seed of approximately 2 ETH from an exchange withdrawal. That wallet then called the createPair function on a decentralized exchange to initialize a SCATMAN/WETH pool. They minted the entire supply—10 trillion tokens—to their own address. No presale, no team allocation, no lock. The liquidity provision was done manually, with a single transaction that added 10 ETH worth of WETH and the entire token supply to the pool. Then they waited.
The tweet from SpaceX hit at exactly 14:32 UTC. Lookonchain’s bot detected the spike in blockchain activity within the same block. By 14:33, the first wave of automated traders had already bought in, pushing the token price from its initial value of effectively zero to a peak market cap of $2 million. The attacker then executed a single sell transaction: 10 trillion tokens for whatever WETH remained in the pool. The price collapsed instantly, and the attacker walked away with 13.5 ETH — $135,000 at that moment. The entire lifecycle lasted 72 seconds. Ledgers do not lie, but liquidity always flees.
The technical execution is trivial. The contract was likely a fork of an existing meme coin template with no unusual modifications. There was no backdoor, no reentrancy attack, no flash loan exploit. The only “bug” exploited was the human tendency to trust a verification badge on X. The attacker didn’t need to write a single line of innovative code; they just needed a target with high social proof and a set of traders willing to bet on a second of liquidity.
### Contrarian View: The Real Vulnerability Is Not Social Media The narrative from most security researchers will focus on account hygiene: enable 2FA, use hardware keys, avoid clicking suspicious links. That advice is valid, but it misses the point. The real vulnerability is structural: in a market where token creation costs $20 and distribution is instantaneous, the only scarce resource is attention. Attackers are not hacking code; they are hacking trust. The verified badge becomes a vector of attack because it confers legitimacy without proof of intent. The blockchain itself is secure. The code is auditable. But the interface between human judgment and machine verification remains wide open.
I watched the ape sell; the code still audits. In 2017, I spent six weeks auditing the 0x protocol smart contracts and found a reentrancy vulnerability that could have drained millions. The fix was a simple ordering of operations. But no amount of smart contract auditing can prevent a user from buying a token because Elon’s company tweeted about it. The vulnerability is not in the EVM; it is in the cognitive bias that equates social proof with value. The attacker understood this. They did not need to exploit a 0-day in the Ethereum client; they just needed a blue checkmark.
This is why my own trading protocol includes a rule I call the “First Tweet Filter.” If a token is being promoted by a major account that has never previously discussed crypto, I treat it as a 100% rug probability. I do not buy. I do not even open the link. The exit liquidity is a courtesy, not a right. In the Bored Ape Yacht Club exit of 2021, I sold 10 BAYC NFTs in 72 hours because the market structure told me liquidity was about to vanish. The same logic applies here: if the only buyer is the next person to see the tweet, you are already the exit liquidity.
### Takeaway: Actionable Levels for the Next Attack This event is not isolated. It is a template. I expect to see more hijacked accounts from domains outside crypto—automotive, aerospace, media—because the pool of credulous traders is still large. The next attack will follow the same pattern: a verified account, a meme coin with no utility, a single liquidity pool on a DEX that does not require KYC. The profit will be higher if the target has a larger audience. The real alpha is not in predicting which token will go up, but in recognizing the pattern and staying out.
Set a manual alert in your on-chain monitoring tool for any token that has 100% of its supply concentrated in one wallet and then paired with a high-ETH pool. When that alert fires, do not buy. Watch the clock. The dump will come within 60 seconds. Strategy is the bridge between chaos and profit. The next time you see a billionaire’s tweet about a meme coin, remember the SCATMAN ledger. It still reads zero.
Trust the protocol, verify the exit.
