Hackers Hijack SpaceX and Starlink X Accounts in a $125K Coin Scam

Hackers hijacked SpaceXAI and Starlink’s verified X accounts on July 12 to launch a meme coin mocking OpenAI chief executive Sam Altman, cashing out roughly $125,000 before the posts vanished. The token, called SCATMAN, traded briefly on Robinhood Chain before its creator drained the pool. Both companies had their accounts back under control by that evening.

It is at least the fourth publicized security scare to hit Robinhood Chain’s meme coin economy in two weeks, and it landed three months after X rolled out a feature built specifically to stop hijacked accounts from doing exactly this.

How the Hijack Played Out on July 12

SpaceXAI is the rebranded X handle for Musk’s artificial intelligence venture, formerly xAI, folded into the SpaceX umbrella in early July. Starlink runs SpaceX’s satellite internet business. SpaceXAI had already made headlines once this month, after Musk denied a report about a SpaceX AI device that briefly rattled the stock.

On Sunday, both accounts began reposting promotional material for SCATMAN from a profile styled Sam Catman, which carried a forged badge claiming SpaceXAI affiliation. Crypto analytics firm SolanaFloor caught it within minutes, writing that the token had instantly rugged after hitting a $2M market cap.

SpaceX’s account carries 2 million followers. Starlink’s has 1.6 million. A single repost from either reaches more people than most crypto projects ever will.

Screenshots that circulated afterward showed the SpaceXAI and Starlink pages resharing the Sam Catman posts, contract address and ticker included. Neither SpaceX, Starlink, xAI nor X issued a statement explaining how access was obtained. Both accounts were restored and the promotional posts deleted by Sunday evening.

The Wallet Trail Lookonchain Traced

On-chain investigator Lookonchain mapped the payout across two wallets. The attacker had pre-minted 10 trillion SCATMAN tokens, and data from DEX Screener showed a single address controlling nearly 90% of the supply before the launch even went live.

Lookonchain traced 73.7 ETH across two wallets tied to the same operator. The gap between the low and high dollar estimates likely comes down to which moment each tracker used to price ether, which traded between about $1,780 and $1,828 that week.

Why Do the Peak Valuations Disagree?

Estimates of SCATMAN’s peak value range from about $2 million to $32 million, and no two outlets fully agree. The spread traces back to timing and methodology. Some trackers measured the token’s fully diluted valuation against its 10 trillion supply, while others tracked the shallow pool buyers actually traded against, numbers that can move independently within minutes on a token this thin.

AMBCrypto put the peak near $2 million before a 98% collapse left just $3,900 in liquidity, across nearly 44,925 transactions. Other outlets, citing the same $5.7 million in 24-hour volume, reported a market cap near $32 million that slipped to about $31 million by the time GeckoTerminal recorded it.

Crypto research outlet Cryip reviewed both readings and said the difference was “likely due to differences in market cap versus fully diluted valuation, timing, or pool data.”

• What we know: SpaceXAI and Starlink’s accounts reposted content from the Sam Catman profile before either company intervened.
• What we know: Lookonchain traced 73.7 ETH in proceeds across two wallets tied to the same attacker.
• What we know: Trading volume hit $5.7 million in 24 hours, a figure multiple trackers agree on even where market cap estimates diverge.

• Unconfirmed: How the attacker gained access to either account.
• Unconfirmed: SCATMAN’s exact peak market capitalization.
• Unconfirmed: Whether SpaceX, Starlink, xAI, Robinhood or any regulator plans a formal response.

SCATMAN is already one entry in a longer list of Robinhood Chain incidents logged this month.

Robinhood Chain’s Rocky First Two Weeks

Robinhood Chain, the Nasdaq-listed brokerage’s new layer-2 network built on Arbitrum’s Orbit stack, went live on July 1 with an institutional pitch: tokenized shares of companies like Nvidia and Apple, trading around the clock. The mainnet launch that wired stock tokens onto the network was meant to be the headline act.

The Meme Coin Pivot

Robinhood co-founder and chief executive Vlad Tenev told CNBC on July 2 that tokenized real-world assets were the durable direction for crypto. Six days later, as a cat-themed token called CASHCAT took off, he posted on X that while the chain is built for real-world assets, “it works great for memes too.”

CASHCAT surged as much as 1,900% in its first 24 hours to a market cap near $110 million, then kept climbing toward $156 million over its first week, a 2,158% gain, according to CoinDesk. The memecoin surge that upended his own thesis forced Tenev’s reversal in public view.

Memecoins made up more than 75% of trading volume on Robinhood Chain in its first week, with total memecoin market cap briefly topping $244 million, according to Crypto Briefing. Tokenized real-world assets, the chain’s flagship pitch, sat at just $12.8 million, about 4.1% of value locked on the network. None of that stopped the chain from pulling in $3.1 billion in cumulative trading volume over seven days, Bernstein analysts noted.

A String of Honeypots and Drainers

Cross-chain platform Relay Protocol warned buyers directly: “If you bought one, the funds you spent are unfortunately gone.” The firm said it was blocking scam tokens engineered to strip themselves from a wallet the moment a purchase clears.

Researchers reported a hacked smart contract drained $56,000 from one CASHCAT holder, and one warned that Robinhood Chain “is absolutely crawling with wallet drainers and fake token scams right now.” Another Robinhood Chain memecoin, HOODIE, halved in a single afternoon. A trader called a third token, ROGE, “a 100% honeypot” with a backdoor built into its contract.

A separate, unverified claim also circulated this month: that Tenev’s own wallet seed phrase had leaked during a livestream, letting an outsider pump a token called $1 to a $14 million market cap before it collapsed. Cryptotimes found no independent corroboration for the claim, and neither Robinhood nor Tenev has addressed it.

A Playbook Scammers Keep Reusing

Hijacking a trusted account to launch a token, then selling into the demand it creates, is not new.

• Pump.fun’s X account, hijacked in February 2025 to push a fake token called PUMP; one wallet made over $135,000 in under a minute.
• Former Malaysian prime minister Mahathir Mohamad’s account, hijacked to promote a token that produced $1.7 million in losses.
• Myanmar’s junta leader and World Liberty Financial co-founder Zach Witkoff, both hit with similar account takeovers in 2025.
• Metallica’s official X account, compromised on June 26, 2026, to promote a Solana-based token called METAL.

Each case follows the same three steps: a trusted account posts, buyers move on borrowed credibility, and the attacker sells before control returns.

X’s Anti-Scam Kill Switch Missed This One

In April 2026, X said it would auto-lock any account posting about cryptocurrency for the first time in its history, forcing extra verification before it could post again. Head of Product Nikita Bier said the change targeted the exact mechanic behind takeovers like this one.

This should kill 99% of the incentive.

Bier wrote on X, adding that Google was not doing enough to stop the phishing campaigns that precede many of these takeovers. The policy went live months before SCATMAN, and CoinDesk reported the auto-lock for first-time crypto posters was meant to make hijacked accounts useless for this exact scheme.

SpaceXAI and Starlink were established corporate handles with years of posting history and, by all appearances, no prior crypto activity, precisely the profile the lock was designed to catch the moment either one turned. Three months after the fix was announced, two of the platform’s most recognizable corporate accounts were still hijacked long enough to mint a token, pump it and cash out.

Robinhood Chain’s meme coins alone topped $244 million in combined market value during the network’s first week of trading. The hacker who hijacked two of Elon Musk’s companies for a slice of that mania walked away with about $125,000, and by evening the tokens were worth nothing at all.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment or legal advice. Cryptocurrencies and meme coins carry a high risk of loss, including total loss, and are frequently used in scams like the one described here. Figures are accurate as of publication and may change as new information emerges.