If a verified star isn't safe, is your brand?

Even the most-followed personal accounts on the internet are getting hijacked to run crypto pump-and-dump scams. It doesn't matter how famous the owner is or whether they've ever touched crypto before. If an account has reach, attackers want it.

This most recent hack proved that point. This influencer and business owner holds one of the largest verified followings on X (roughly 39.5 million people) with zero prior history of promoting crypto. And her account still got hijacked in minutes.

If an account with that level of visibility can be weaponized in minutes, then standard corporate accounts don’t stand a chance without the right defenses. In this blog post, we'll break down what happened to this X account, why you should care, and the exact steps you can take right now to protect your own accounts from a takeover.

What happened to this business owner's X account?

On August 24, 2026, a huge X account was hijacked and used to run a cryptocurrency scam. Here's what we know:

The verified X account, which carries roughly 39.5 million followers, was hijacked and used to promote a Solana memecoin launched on Pump.fun, Solana's dominant memecoin launchpad.

The first post appeared on the account at 21:43:42 UTC and read: "welll lets try this trading thing out… follow me on pumpfun cutekjenner." Two minutes and 41 seconds later, a second post shared a ticker and the full Solana contract address ($kylie 6b7KQsXqb6JR5Nmeer5zGRmo51dwDfttM5b5Nu2rpump).

The two posts drew roughly 50,000 and 33,000 views respectively before they were deleted. On-chain tracker SolanaFloor publicly flagged the activity at 22:10:53 UTC, describing the account as "likely compromised."

Buying pressure pushed the token's market cap from near-zero to an all-time high of about $1.21 million within minutes. Once the posts were deleted and the compromise became clear, aggressive selling followed and the market cap crashed more than 90% to below $120,000.

Within hours, a wave of copycat branded tokens appeared on Solana, some briefly crossing $1 million in market cap as opportunists rode the visibility created by the original attack.

Neither the influencer nor her representatives issued any public statement or confirmed a hack at the time of reporting.

This was one of many high-profile accounts hit by this exact playbook. It follows a documented pattern that includes Kylian Mbappé ($MBAPPE, 2024), Drake ($ANITA, 2024), actor Dean Norris ($DEAN, 2025), and the reactivated Roaring Kitty account ($RKC, 2026). This is a repeatable attack, not a one-off.

Why should you pay attention to this hack?

This influencer’s fame meant the scam was flagged fast. But most brands don't get on-chain trackers and millions of skeptical followers watching in real time, so a hijacked account can scam your customers and burn years of trust before anyone catches it.

What’s worse is that this trend isn't slowing down, and the data makes that clear:

• High-profile accounts give hackers instant access to built-in trust. As this breach demonstrated, a single compromised account can put a scam in front of tens of thousands of users in minutes.
• Global cybercrime expenses are projected to grow 15% annually, reaching $10.5 trillion globally this year and scaling to $12 trillion by 2031, according to Cybersecurity Ventures.
• Malware-free activity accounted for 79% of threat detections in 2024, up from 40% in 2019, according to CrowdStrike’s 2025 Global Threat Report. Social engineering and credential theft are now doing most of the work.
• According to KnowBe4's 2025 Phishing Threat Trends Report, phishing volume rose 17.3% in a six-month span, and 57.9% of those phishing emails were sent from already-compromised accounts.

That’s why relying solely on social media platforms to protect your corporate assets is a losing strategy. For instance, X had publicly promised an automatic account-lock system to stop exactly this kind of attack, yet it failed to confirm whether that protection was active during the influencer’s breach.

When native platform controls fail at this scale, security falls entirely on your internal protocols, and taking ownership of that defense is the only way forward.

How to protect your X account from hacks

The influencer’s team hasn't shared how attackers got in. But takeovers like this usually come down to weak credentials, phishing, or a stolen session. The good news is that you can reduce your attack surface and make your account far harder to breach.

Here's what we recommend you do right now:

1) Use strong passwords across all accounts

Your password strength is one of the easiest ways attackers measure how hard your account will be to breach. That's why, as your first layer of defense, you should make it as strong as possible and never reuse it across platforms.

A strong password is long, random, and unpredictable. Aim for at least 16 characters, and mix uppercase letters, lowercase letters, numbers, and special symbols so it can't be guessed or brute-forced so easily.

Note: If you're worried about remembering them all, use a password manager to securely create, store, and retrieve them. A few good options include Proton Pass, 1Password, and Bitdefender SecurePass.

2) Use authenticator apps for 2FA (for individuals)

Two-factor authentication (2FA) adds a second lock to your account, requiring a time-sensitive code on top of your password. This alone stops 99.9% of brute-force attacks.

But you should never use SMS for 2FA. Phone numbers can be hijacked through SIM swap attacks, where an attacker convinces your carrier to move your number to their device and intercepts your codes. Codes can also be stolen with malware like info stealers, so avoid using it. Instead, use an authenticator app on a separate device.

3) Enable 2FA for teams

Authenticator apps are great for individuals, but they get messy for businesses. For example, we’ve found that sometimes multiple people need access to the same account, and sharing a single code quickly becomes a security problem.

That's where team-based 2FA comes in. At Spikerz, we host and manage 2FA tokens through a secure web-based dashboard for your whole team, so nobody has to share codes over Slack or WhatsApp.

That kind of habit is exactly what creates a goldmine for hackers. One screenshot of a code in a group chat is all it takes to hand your account to the wrong person.

4) Regularly review and revoke account access

It's key to regularly review who has access to your accounts. People naturally leave organizations, and sometimes they keep admin rights they no longer need.

As you may imagine, that's a major problem for security. If one of those forgotten accounts gets hacked, you can lose your own account through them. In fact, we’ve seen this cause a lot of damage before. That's why you should revoke access whenever necessary to reduce that risk.

5) Protect your local devices with antivirus software

While 2FA and monitoring stop most threats, they aren't perfect. Some attacks let hackers bypass your password and 2FA altogether by stealing your login session.

To prevent this, use traditional antivirus software, which scans your device for malicious software and removes it before it can steal your data. We recommend Bitdefender as one of the best options for stopping info stealers.

6) Enable account monitoring

Social media account monitoring watches your accounts around the clock for suspicious activity and alerts you the moment something seems suspicious. The goal is to detect and prevent takeover attempts and stop malicious posts before they go live. The entire attack we mentioned above unfolded in under three minutes, proving that manual responses are simply too slow.

While there are many monitoring tools on the market, you should choose one that focuses on security and offers the strongest defense. For example, Spikerz is an all-in-one social media security platform that helps brands protect their digital presence.

We connect through official APIs in a few clicks, so you're protected without ever handing over your passwords. Here's what we do:

• Account takeover protection: blocks unauthorized access and hijacking attempts in real time.
• Phishing protection: scans incoming DMs and links, neutralizing threats before anyone clicks.
• Permissions management: gives you full visibility and control over who can access your accounts.
• Impersonator takedown: finds and removes fake brand accounts, maintaining a 95%+ removal rate on Meta.
• Comment moderation: automatically hides scams, spam, and hate speech across your posts.

If a single breach can exploit millions of followers in under three minutes, how much would a takeover cost your business?

Book a demo with Spikerz today to lock down your brand’s social presence and ensure you never have to worry about this happening to you.

7) Create a social media policy

A social media policy is a clear set of rules that decides who gets access to your accounts, what they're allowed to publish, and how they should use them.

If you want to create one in minutes, use our customizable template. It covers a customized policy based on your teams, accounts, and risks, a review of your current security blind spots, and a workflow for approval, access, and crisis response.

8) Build a rapid response team (RRT)

Even with strong defenses, no account is fully hackproof, so you should always prepare for the worst. A rapid response team is a small group across your social media and security teams that's ready to identify a breach and respond before the damage spreads.

Look at this hack as an example. The scam posts hit a 39.5-million-follower audience and moved over a million dollars in market cap in the roughly two minutes before deletion, and copycat tokens kept the fraud alive for hours afterward.

Now contrast that with a business that spots the intrusion early and re-secures the account before a single scam post reaches its followers. That's the difference between a quick scare and a crisis that plays out in public.

Conclusion

Attackers go where the audience is, and a trusted, verified account is one of the most valuable things a hacker can hold, even for a few minutes. What separates a quick scare from a full-blown crisis isn't luck, it's preparation.

So go ahead and reduce your attack surface ahead of time so hackers never get the chance to post from your account in the first place. Use strong passwords, team-based 2FA, tight access control, and around-the-clock monitoring.