Buy Crypto- Markets
Futures- Spot
- Copy Trade
- Earn
- More
ZachXBT Latest Survey: How Did 'Fortnite' Esports Pros Use a Meme Scam to Steal $3 Million?
Original Author: zachxbt, On-chain Detective
Original Translator: zhouzhou, BlockBeats
Editor's Note: This article analyzes how the hacker Serpent took control of accounts belonging to McDonald's, Kabosu, and others on X and Instagram, initiated a Meme Coin scam, stole approximately $3.5 million, and used it for casino gambling. Serpent was a professional player of "Fortnite" who was dropped due to cheating. In 2022, a rug pull occurred in the NFT project DAPE, co-founded by him. In 2024, the ERROR project he launched also faced a rug pull and was ultimately banned by X.
The following is the original content (slightly reorganized for better readability):
Over the past few months, I have been tracking a series of related data breaches involving McDonald's, Usher, Kabosu's owner, Andy Ayrey, Wiz Khalifa, SPX 6900, etc., which resulted in approximately $3.5 million in theft through the release of Pump Funmeme Coin.
On August 21, 2024, McDonald's Instagram account was hacked, and a promotional post for the meme coin GRIMACE was published, after which the hacker began to engage in mischief. Over $690,000 was transferred to two wallets from this pump and dump event.
4RiNhTwBxYWgb4MSCtt9vXgVk2yuPhoQR3DR9pMVPU1W
2vjnmxwTYNJvTmFhtqxZkPiuCHkaKZK5rcxTLuoC2dPB
On September 3, 2024, the McDonald's attacker moved 101.5 SOL to two addresses, and after actor Dean Norris's X account was compromised by the hacker, these two addresses were deployed to and targeted SCHRADER.
4s9Uz9pTBXcEaEtcjs8eg98r2TVte3rq3JUm3rVTFMudfewGbNKmqNyYs9bSAMDUaTbTcuA1v39sWr7GRqkDJ6EM
1gxo1pjTqjbee7rHW4cGvuNffX1qP4F8fP17g6SSC5EYbQrnktDrKSFB1uh4ju7PxQjprWFin37WUsAe225b9c6
On September 6, 2024, funds from a McDonald's APT (Account Takeover) were transferred to a casino deposit address.
CuNzegC9DE4CxCMn31ZcYLvtDaYsLD9RX8eRvmtZQrnB
Through timeline analysis, subsequent withdrawals shortly after the deposit can be identified.
B2fwZt5nTbdrnJ2CPsgrYMPuB4UnhN82EAM34dXDARLh
On September 12, 2024, B2fw transferred 110 SOL to two addresses involved in a meme coin presale promoted during the Usher leak event.
4FUrwoHz1fuUf4eR6YEAYSG9d9rN5fzbowMXtbjwJAhTDtHXjpnTb1sz6aeF6T79JaiMFyT2xX2EuTxqT5UhFfKD
427zpHF1WWgYgKxcSiUzwXLg2UqsF6xq7K13PU3mh6Wr99mipiVA6GcDTwi7EY93RJeRuEUDZAK9BnoMeki7sU6C
Subsequently, B2fw transferred 4868 SOL to the casino deposit address ECb5v, which is directly linked to other APT events, including the Andy Ayrey and Enoshima Aquarium leaks.
Ecb5vsomUG3MEnLCgiFvkdnnqpggTEXtN17z62iDPuU3
On October 15, 2024, Enoshima Aquarium's X account was breached, promoting a bundled meme coin. On the same day, 84 SOL obtained from this scam was transferred to ECb5v.
5PDjh74JTLMPW4dXr6fKm3Yue2j3vhbxLSK5dPbQ3oEGK4axE7fua1ngBMas4xpRY6dBr92Ccps7b1WwcLdnxXWL
On October 29, 2024, Andy Ayrey (Founder of Truth Terminal) had his X account compromised, which lasted for several days and promoted 6 meme coin scams. 3GVUs was one of the addresses involved in buying the tokens.
3GVUs2gNr161ohqnVXjUeoNQmf3cELxKSiPrxyQu6pjd
On October 30, 2024, 3GVUs transferred 169 SOL to Ecb5vs.
67nwsLLE3aGua4VeH8p6qHc3SL3rpxi9omMxRnfpeyZVsBpZawnUHo4Pt4tdT5Vxny2uRNRDH3vSZ1fzvKkNCML4
Out of the $2.178 million obtained from Andy Ayrey's ATO, $750,000 was deposited into a casino deposit address Apc3e.
Apc3eA9ScQksuZvfURQswZwVkusEYRaqeKEv4eXXbRZm
0.1 SOL from the Kabosu ATO funded an address that participated in the Andy Ayrey ATO.
On October 17, 2024, the owner of Kabosu's Instagram account was hacked and promoted a meme coin scam.
That day, 191 SOL from the scam was transferred to a casino deposit address:
6kwZ7tz8Xs7jaVqVJXZSRrZ2FtS2PPChEVuLXKrmMgCm
The APT (Account Takeover) events of Kabosu and Andy Ayrey are directly related to Wiz Khalifa's APT event.
On November 3, 2023, an attacker posted a wallet address on Wiz Khalifa's account. 29 SOL was transferred to 6kwZ7, similar to what happened in the Kabosu ATO.
NFCs23ddXQc9Zff2VJotEn2zaSAh4tvw6U6kb7fdXovZ8YPQgJMGQkXmtWiTutqnoBf6wR2khaKvFpyEKNhHfjJ
WIZ's deployer funds came from Andy Ayrey's ATO. Other addresses involved in the exploit redirected all gains obtained through instant swaps to a casino deposit address 0x83ee.
0x83ee6b53a0ae76b71bed0c32721a451776dbdb3a
On October 16, 2024, 0x83ee received 0.54 ETH from the scam's deployer, while SPX 6900 was compromised on October 11, 2024.
On Solana, another scam promoted by the compromised SPX 6900 account received backing from the Ken Carson attacker.
To further demonstrate the relationship between Kabosu's owner, SPX 6900, Ken Carson, and Enoshima ATO, each meme coin's deployer provided funds to the previous deployer's address through instant swap funds, attempting to obscure the origin of the funds.
Investigate how threat actor Serpent transitioned from a professional Fortnite player to aiding in a memecoin scam initiated through leaks from 9+ accounts on X and IG to steal $3.5M and use the proceeds for online casino gambling.
Serpent (SerpentAU) is a former professional Fortnite player from Australia, who was released by the esports organization "Overtime" in June 2020 after being found cheating. He then co-founded the NFT project DAPE in March 2022, which later rug-pulled.
In March 2024, Serpent launched another project called ERROR, but the project rug-pulled, leading to his ban from platform X.
Deployer Address:
0x8233873ee35547097ccb9098adbab955d7120ee8
On October 23, 2024, the ERROR deployer moved a total of 29 ETH to two instant exchanges.
Through time analysis, it was observed that these funds were received on Solana and transferred to the same gambling deposit address.
Ecb5vsomUG3MEnLCgiFvkdnnqpggTEXtN17z62iDPuU3
Multiple ATO (Aggressive Transaction Outcomes) directly linked to the deposit address Ecb5vs include: McDonald's, Usher, Andy Ayrey, Dean Norris, and Enoshima Aquarium. (For detailed tracking, please refer to the beginning of the document.)
Serpent gambles monthly on Roobet, Stake, BC Game, and Shuffle with stakes of millions of dollars, often screen sharing with friends on Discord.
I obtained recordings of his gambling sessions, where he inadvertently disclosed multiple deposit and withdrawal addresses.
Discord ID: 1269557350486904945
During a screen sharing session on November 1, 2024, Serpent shared a $100K deposit and $200K withdrawal, transferred to the following address.
When plotting the transaction graph, it was discovered that this address had high exposure to addresses associated with McDonald's, Andy Ayrey, and Usher ATO.
0xb8c9c8a5756a7992df65f949b7c1423eeb435aa5
During Andy Ayrey's security breach incident, another threat actor participated in hijacking these fraudulent projects, using the alias "Dex" (from Massachusetts, USA).
After I mentioned him in my Telegram channel last week, he started to panic and fabricated a story about being extorted, claiming to have lost $700K. 
The funds currently related to these security breaches are stored in the following addresses:
0xeb60a5242c1c97eb54195ec83de43bb26813c0d1
0x2355ac2929bb7051814de3c48670fccbb515d8be
4jjWZ8RaXZBqntnhu2JFidXEQWXgfKRbJQZdTHrdaqbv
Today, following the release of the first part of my investigation, Serpent started deleting all his posts on the new X account. I suspect there are still some ATO (Attack Transaction Activity) incidents related to this that I have not been able to directly trace on-chain. Regarding one of the breached accounts, I have shared a detailed investigation report with one of the victims I am collaborating with.
You may also like
Found a "meme coin" that skyrocketed in just a few days. Any tips?
TAO is Elon Musk, who invested in OpenAI, and Subnet is Sam Altman
The era of "mass coin distribution" on public chains comes to an end
Soaring 50 times, with an FDV exceeding 10 billion USD, why RaveDAO?
1 billion DOTs were minted out of thin air, but the hacker only made 230,000 dollars
After the blockade of the Strait of Hormuz, when will the war end?
Before using Musk's "Western WeChat" X Chat, you need to understand these three questions
The X Chat will be available for download on the App Store this Friday. The media has already covered the feature list, including self-destructing messages, screenshot prevention, 481-person group chats, Grok integration, and registration without a phone number, positioning it as the "Western WeChat." However, there are three questions that have hardly been addressed in any reports.
There is a sentence on X's official help page that is still hanging there: "If malicious insiders or X itself cause encrypted conversations to be exposed through legal processes, both the sender and receiver will be completely unaware."
No. The difference lies in where the keys are stored.
In Signal's end-to-end encryption, the keys never leave your device. X, the court, or any external party does not hold your keys. Signal's servers have nothing to decrypt your messages; even if they were subpoenaed, they could only provide registration timestamps and last connection times, as evidenced by past subpoena records.
X Chat uses the Juicebox protocol. This solution divides the key into three parts, each stored on three servers operated by X. When recovering the key with a PIN code, the system retrieves these three shards from X's servers and recombines them. No matter how complex the PIN code is, X is the actual custodian of the key, not the user.
This is the technical background of the "help page sentence": because the key is on X's servers, X has the ability to respond to legal processes without the user's knowledge. Signal does not have this capability, not because of policy, but because it simply does not have the key.
The following illustration compares the security mechanisms of Signal, WhatsApp, Telegram, and X Chat along six dimensions. X Chat is the only one of the four where the platform holds the key and the only one without Forward Secrecy.
The significance of Forward Secrecy is that even if a key is compromised at a certain point in time, historical messages cannot be decrypted because each message has a unique key. Signal's Double Ratchet protocol automatically updates the key after each message, a mechanism lacking in X Chat.
After analyzing the X Chat architecture in June 2025, Johns Hopkins University cryptology professor Matthew Green commented, "If we judge XChat as an end-to-end encryption scheme, this seems like a pretty game-over type of vulnerability." He later added, "I would not trust this any more than I trust current unencrypted DMs."
From a September 2025 TechCrunch report to being live in April 2026, this architecture saw no changes.
In a February 9, 2026 tweet, Musk pledged to undergo rigorous security tests of X Chat before its launch on X Chat and to open source all the code.
As of the April 17 launch date, no independent third-party audit has been completed, there is no official code repository on GitHub, the App Store's privacy label reveals X Chat collects five or more categories of data including location, contact info, and search history, directly contradicting the marketing claim of "No Ads, No Trackers."
Not continuous monitoring, but a clear access point.
For every message on X Chat, users can long-press and select "Ask Grok." When this button is clicked, the message is delivered to Grok in plaintext, transitioning from encrypted to unencrypted at this stage.
This design is not a vulnerability but a feature. However, X Chat's privacy policy does not state whether this plaintext data will be used for Grok's model training or if Grok will store this conversation content. By actively clicking "Ask Grok," users are voluntarily removing the encryption protection of that message.
There is also a structural issue: How quickly will this button shift from an "optional feature" to a "default habit"? The higher the quality of Grok's replies, the more frequently users will rely on it, leading to an increase in the proportion of messages flowing out of encryption protection. The actual encryption strength of X Chat, in the long run, depends not only on the design of the Juicebox protocol but also on the frequency of user clicks on "Ask Grok."
X Chat's initial release only supports iOS, with the Android version simply stating "coming soon" without a timeline.
In the global smartphone market, Android holds about 73%, while iOS holds about 27% (IDC/Statista, 2025). Of WhatsApp's 3.14 billion monthly active users, 73% are on Android (according to Demand Sage). In India, WhatsApp covers 854 million users, with over 95% Android penetration. In Brazil, there are 148 million users, with 81% on Android, and in Indonesia, there are 112 million users, with 87% on Android.
WhatsApp's dominance in the global communication market is built on Android. Signal, with a monthly active user base of around 85 million, also relies mainly on privacy-conscious users in Android-dominant countries.
X Chat circumvented this battlefield, with two possible interpretations. One is technical debt; X Chat is built with Rust, and achieving cross-platform support is not easy, so prioritizing iOS may be an engineering constraint. The other is a strategic choice; with iOS holding a market share of nearly 55% in the U.S., X's core user base being in the U.S., prioritizing iOS means focusing on their core user base rather than engaging in direct competition with Android-dominated emerging markets and WhatsApp.
These two interpretations are not mutually exclusive, leading to the same result: X Chat's debut saw it willingly forfeit 73% of the global smartphone user base.
This matter has been described by some: X Chat, along with X Money and Grok, forms a trifecta creating a closed-loop data system parallel to the existing infrastructure, similar in concept to the WeChat ecosystem. This assessment is not new, but with X Chat's launch, it's worth revisiting the schematic.
X Chat generates communication metadata, including information on who is talking to whom, for how long, and how frequently. This data flows into X's identity system. Part of the message content goes through the Ask Grok feature and enters Grok's processing chain. Financial transactions are handled by X Money: external public testing was completed in March, opening to the public in April, enabling fiat peer-to-peer transfers via Visa Direct. A senior Fireblocks executive confirmed plans for cryptocurrency payments to go live by the end of the year, holding money transmitter licenses in over 40 U.S. states currently.
Every WeChat feature operates within China's regulatory framework. Musk's system operates within Western regulatory frameworks, but he also serves as the head of the Department of Government Efficiency (DOGE). This is not a WeChat replica; it is a reenactment of the same logic under different political conditions.
The difference is that WeChat has never explicitly claimed to be "end-to-end encrypted" on its main interface, whereas X Chat does. "End-to-end encryption" in user perception means that no one, not even the platform, can see your messages. X Chat's architectural design does not meet this user expectation, but it uses this term.
X Chat consolidates the three data lines of "who this person is, who they are talking to, and where their money comes from and goes to" in one company's hands.
The help page sentence has never been just technical instructions.
Parse Noise's newly launched Beta version, how to "on-chain" this heat?
Is Lobster a Thing of the Past? Unpacking the Hermes Agent Tools that Supercharge Your Throughput to 100x
Declare War on AI? The Doomsday Narrative Behind Ultraman's Residence in Flames
Crypto VCs Are Dead? The Market Extinction Cycle Has Begun
Claude's Journey to Foolishness in Diagrams: The Cost of Thriftiness, or How API Bill Increased 100-Fold
Edge Land Regress: A Rehash Around Maritime Power, Energy, and the Dollar
Arthur Hayes Latest Interview: How Should Retail Investors Navigate the Iran Conflict?
Just now, Sam Altman was attacked again, this time by gunfire
Straits Blockade, Stablecoin Recap | Rewire News Morning Edition
From High Expectations to Controversial Turnaround, Genius Airdrop Triggers Community Backlash
App