A security breach on X resulted in the theft of over $2.2 million worth of meme coins on Solana.
Blockchain investigator ZachXBT revealed the attack exploited a vulnerability in X’s mobile platform, leading to losses across multiple tokens in what appears to be a sophisticated phishing operation against Wallstreetbets.
The attack resulted in the theft of multiple tokens, with the major losses including $1.43 million in PNUT, $400,000 in ZEREBRO, and $130,000 in ALCH tokens.
According to ZachXBT’s Telegram announcement, the attackers exploited a previously identified bug in X’s mobile platform. This allowed them to add passkeys to compromised accounts—a vulnerability that remained invisible to original account owners and wasn’t being properly addressed by platform support.
The vulnerability affects the platform’s mobile interface, allowing attackers to maintain persistent access even after apparent account recovery attempts.
Wallstreetbets regains access to the account
Wallstreetbets has since regained control of their account. He also confirmed that the unauthorized tweets containing malicious links had been posted during the compromise.
The account holder revealed they had been battling unauthorized access attempts for approximately one month. The user is also working in conjunction with X’s security team to resolve the continuous security issues.
In a direct message to the attackers, Wallstreetbets issued a stern warning, claiming knowledge of their identities despite their use of VPN services to mask their activities.
“Hiding your logins to my account with a VPN is a laughably weak way to cover your tracks,” the account stated. Wallstreetbets suggested possible legal consequences for the criminal activity.
The account holder has also reached out to potentially affected users, requesting them to share details of any losses through direct messages. This information is intended to be forwarded to authorities as part of ongoing investigations into the security breach.
Wallstreetbets wasn’t the only major breach on Sunday. Cardano’s X account was also hacked, with details of a phony U.S. Securities and Exchange Commission lawsuit posted before being taken down.
