SpaceX, Starlink accounts hijacked to push SCATMAN token

On July 12 verified X accounts for SpaceX and Starlink were hijacked and used to promote a memecoin called SCATMAN. Company teams regained control of the accounts and removed the promotional posts later that evening.

Onchain analytics firm Lookonchain reported the attacker minted 10 trillion SCATMAN tokens and sold them across two wallets, receiving about 59 ETH (roughly $108,000) from one sale and 14.7 ETH (about $27,000) from the other, together totaling about 73.7 ETH (around $135,000).

Trading activity pushed the token’s reported market capitalization to about $32 million and raised 24‑hour trading volume to roughly $5.7 million before liquidity collapsed and prices fell.

SCATMAN was deployed on Robinhood Chain, a layer‑2 network that launched July 1. The chain permits permissionless token deployment, allowing anyone to create tokens without prior approval.

Relay Protocol reported it is blocking honeypot tokens as they appear and verifying safe listings. Onchain records show the attacker converted proceeds to ether and moved funds across multiple wallets, creating a transaction trail.

The sequence in this incident-hijacked verified account, token promotion tied to a recognized brand, and rapid token sales during a buying spike-has appeared in other account compromises. Buyers who purchased after the posts suffered losses once liquidity drained.

At the time of reporting, neither SpaceX nor X had provided a detailed explanation of how the accounts were breached. Investigators and blockchain trackers are following the wallet movements as a starting point for any enforcement or recovery actions.