Ether.fi (ethfi) 
On-chain investigator ZachXBT has uncovered links between the hacks of two Hollywood celebrities’ X accounts, which were used to create meme coin scams, and convicted UK hacker Gurvinder Bhangu, also known as Gurv.
In a recent X thread on July 30, ZachXBT shared his research into the high-profile hacks of actors Sydney Sweeney and Bob Odenkirk’s X accounts. These accounts were exploited to promote scam meme coins, reportedly generating $530,000 in stolen funds.
ZachXBT’s investigation revealed that on July 2, Sweeney’s X account was compromised, leading to posts promoting a Solana-based token called “$SWEENEY.” Within just two hours, the scam token saw over $10 million in trading volume, causing its price to spike and then crash.
The attack coincided with reports that Sweeney’s Verizon phone number was hijacked. A Verizon receipt from the same day confirmed that Sweeney was a victim of a SIM-swapping attack.
According to ZachXBT, Gurv — previously convicted in the U.K. for hacking Instagram accounts and blackmailing users — received verification codes for Sweeney’s account via Telegram, strengthening the link between Gurv and the hack.
ZachXBT noted that the hacker used the same Telegram user ID to receive codes across multiple groups, discussing his time in prison and linking it to the hacks. The proceeds from the attack were initially transferred as Solana to an exchange, where they were swapped for Bitcoin and Ethereum before being dispersed to several addresses. This on-chain activity suggests multiple people were involved in the scam.
On July 9, another 1.5 ETH was sent to an exchange from a wallet connected to the Sweeney SIM swap.
Further investigation linked the Sweeney hack to another similar attack on actor Bob Odenkirk’s X account, also on July 9. After compromising Odenkirk’s X account, the hacker(s) launched and posted about two scam meme coins, KIRK and SAUL. Due to the divided attention between the two coins, the scammers ended up stealing fewer funds this time.
At the time of ZachXBT’s reporting, the wallets connected to both the Sweeney and Odenkirk scams hold approximately $488,000. The remaining funds have been transferred to crypto casinos and used to purchase gift cards. ZachXBT concluded the X thread with a call to local law enforcement: “Hopefully UK law enforcement will be quick to go after Gurv again using the large amount of evidence available.”
The Sweeney and Odenkirk scams highlight a growing trend of celebrities’ accounts being compromised or used in social engineering scams to promote fraudulent meme coins.
Stay updated on the latest cryptocurrency news and insights at Global Crypto News.
