A hacker rug pulled a token called SCATMAN after reportedly seizing control of the SpaceXAI and Starlink accounts on X, walking away with roughly $125,000 in Ethereum (ETH).
On-chain tracker Lookonchain traced the stolen funds across two wallets. The scheme mirrors a run of high-profile account takeovers aimed at promoting fraudulent tokens.
Inside the SCATMAN Rug Pull
According to Lookonchain, the attacker promoted the SCATMAN meme coin after allegedly compromising the SpaceXAI and Starlink X accounts. Screenshots widely shared on social media appeared to show both accounts reposting content from the SCATMAN account.
Lookonchain said the attacker minted 10 trillion SCATMAN. They then sold the entire supply for 59 ETH, worth about $108,000.
The analytics platform also identified a second wallet linked to the same attacker that sold an additional 59.28 million SCATMAN tokens for 14.7 ETH, worth approximately $27,000.
In total, the two wallets generated nearly $125,000 in ETH. Lookonchain identified the following addresses as belonging to the attacker:
- 0xfee50d4ce48f2d05f520ce04c875647e4870a8ba
- 0xdd9f6d3e16ebda7f35cb694ceadb50af3eebba89
As of press time, the reposts were no longer visible on the SpaceXAI and Starlink accounts, and BeInCrypto could not independently verify the claims. BeInCrypto has reached out to SpaceX for comment and will update this story if it receives a response.
Account Hacks Fuel a String of Rug Pulls
Hijacked social media accounts have become a common vehicle for rug pulls. Scammers borrow the credibility of trusted brands to lure buyers.
In February 2025, hackers seized Pump.fun’s X account to push a fake PUMP token. One wallet earned over $135,000 within a minute.
Political figures have faced the same tactic. Attackers hijacked former Malaysian Prime Minister Mahathir Mohamad’s account to promote a token, stealing $1.7 million.
Myanmar’s junta leader and World Liberty Financial co-founder Zach Witkoff faced similar breaches earlier that year.
Victims range from crypto platforms to heads of state. The common thread is a trusted account weaponized for a single, fast payout.
Each case follows the same pattern. A breach, a fast token launch, and a quick sell-off before the platform regains control.
Source: BeInCrypto
