Million-Dollar Promotion Scandal: ZachXBT Exposes Overseas KOL Paid Promotion Industry

Original Title: "A Showcase of Foreign KOLs' Rug-Pulling Tactics: Clustering, Hype, and Concealment"

Original Authors: San, David, Deep Tide TechFlow

On September 1, while the market's attention and liquidity were focused on Trump's $WLFI, renowned on-chain sleuth @ZachXBT started exposing scandals again.

He revealed a spreadsheet listing overseas KOLs paid for promotions, documenting multiple English-speaking KOLs on the X platform who engaged in paid promotions for crypto projects. The list includes quite a few accounts, with total payments exceeding 1 million USD; the price per post varies by the KOL's influence, ranging from $1,500 to $60,000.

ZachXBT pointed out that among the KOLs on this list, fewer than five accounts labeled their promotional posts as "advertisement." This means that for the vast majority of KOLs, when they post publicly on social media, you can't tell whether it's a paid promotion or a genuine, spontaneous share.

Subsequently, another sleuth, @dethective, further analyzed and organized the original spreadsheet, discovering even more creative tactics among these overseas KOLs when it comes to paid promotions.

Multiple Accounts per Person, Double Dipping from Projects

In @dethective's analysis, the first issue that stood out was that some wallet addresses appeared multiple times on the list.

This means that the same wallet might correspond to multiple KOL accounts, yet received promotional payments from the same project two or more times.

Take the accounts @Regrets10x and @lynk0x as examples. The list shows the former received $8,000 for four posts, while the latter received $12,000 for the same number of posts, possibly due to differences in follower count.

But their wallet addresses are identical:

EKvYizd 7 LqTmMj 4 QqmKsHm 8 wdg 7 TXzFoHHg 664 FdnhCRh

After cross-referencing, blogger @dethective found that there are about 10 similar cases of duplicate wallets on the entire list.

One possible reason is that some overseas KOLs, in order to expand their influence, use alternate or affiliated accounts for promotions but don't bother changing wallet addresses, thus exposing their tracks.

But thinking deeper, whether due to laziness or oversight, not changing wallet addresses actually reflects a clustering hype strategy: multiple accounts posting about the same project at once can more easily dominate social media timelines and attention, triggering FOMO among followers.

Of course, the two KOLs exposed didn't just sit idly by.

@lynk0x denied receiving money in the comments, saying @Regrets10x was just a friend and the wallet sharing was purely coincidental. But @dethective quickly produced evidence:

This wallet received $60,000 from an airdrop by a project called "Boop," and to claim the airdrop, an X account must be linked. This indirectly proves the control relationship between the account and the wallet, making denial hard to stand up to scrutiny.

@Regrets10x's response was more casual; he didn't directly address the accusation, instead saying that as long as he disclosed paid promotions when posting, there was no problem.

It's understandable to take paid promotions, and proper disclosure helps others understand the motives and interests behind posts. Some more professional KOLs often add a line like "related interests" or "no related interests" at the end of a post.

But the problem is, if two accounts belong to the same person and post the same promotional content, one openly reminds followers it's an ad, while the other stays silent, this is more like a persona-building strategy using an account matrix.

Some take this mass account promotion tactic and turn it into an entire industry chain.

Previously, research institute DFRLab published a study titled "Anatomy of Crypto Scams on Twitter," mentioning that some gray-market operations can control dozens of accounts, posting nearly 300 tweets daily. They create fake public approval through mass account farming, automated retweets and replies, and cross-endorsement.

Operators usually buy old accounts or register new ones in bulk, change nicknames and avatars, and become brand new KOLs. Then, using scripts, they copy the same promotional phrases into the comments of high-traffic tweets to "attract followers."

"To The Moon"

After the list was exposed, another noteworthy point was that the profits in these overseas KOLs' wallets often overlapped highly with the tokens they promoted.

In other words, they weren't just randomly sharing "insights"—they received tasks first, promoted the tokens, and then traded them themselves.

For example, the account @0xSweep, according to @dethective's wallet analysis, made most of his profits from several tokens on the BullX trading platform: $AETHER, $BOB, $BARSIK, and so on.

The backstory is that all these tokens were on ZachXBT's exposed list of paid promotions; @0xSweep also repeatedly mentioned them in his X posts, claiming the tokens had great potential and were likely "to the moon."

But his wallet records show that these profitable trades occurred right before or after the promotions, making it highly likely that the project paid him to post, and after the post boosted the token's popularity, he traded to show activity.

This also means that if an account keeps telling you about their trading insights, their income may not actually come from trading or market judgment.

A similar case is @ShmooNFT. His Telegram channel promotes about 10 tokens daily, which at first glance seems like enthusiastic sharing.

But wallet tracking shows his only profitable trades—$DEGE, $BON, $BOTIFY—were all promoted on X and appeared on ZachXBT's earlier exposed list.

The core issue with this model is that the KOL's "advice" is biased: promotional posts aren't labeled as ads, so fans think it's a sincere recommendation, when it's actually a paid collaboration.

If the token really has potential, everyone wins, but if the meme coins keep going to zero, the KOL's own credibility and influence will also decline.

The subtlety of this tactic is that these overseas KOLs may be profiting in three ways.

First, they get free tokens through airdrops, then collect promotional fees from the project, and finally, after hyping up the price, sell off the airdropped tokens.

There's also a common advanced tactic: after showcasing profits and building an image as a "trading god," they set up paid groups and charge "membership fees."

Where There's Demand, There's a Market

At the end of the analysis, dethective raised a thought-provoking question:

Why do some project teams, knowing the habits and tricks of certain overseas KOLs, still choose to work with these accounts?

The answer is: where there's demand, there's a market.

Some projects prefer audiences who "want to get rich quick," and some of the accounts exposed earlier have channels and groups that perfectly attract this audience: those lacking independent research ability, more likely to trust calls and luck, hoping to discover an undervalued golden dog.

Often, such KOL accounts are defined as "more commercially valuable" in a marketing market where bad money drives out good.

Exposing these scandals involves conflicts of interest and can easily cause trouble without reward; but if just one or two promoted tokens succeed, it's easy for the KOL to be spread as a trading master.

In a market where noise and truth are hard to distinguish, crypto investing isn't as simple as following someone's calls. There will always be influencers who claim to always win, but lost funds never return.