The cryptocurrency spam treadmill
In which a swarm of X accounts posts a bunch of identical posts in an effort to get various cryptocurrency tokens to trend
Unless you spend too much time online, you almost certainly missed it, but $ORM trended briefly on X the other day. ($ORM is a cryptocurrency token that you've probably never heard of and probably shouldn't buy unless you enjoy wasting money in esoteric ways.) Unsurprisingly, this trend did not arise organically; instead, it was driven by a flock of inauthentic accounts that spammed the platform with thousands of posts in a short span of time. These posts are similarly worded (and frequently identical), and the swarm of accounts posting them has some odd characteristics as well, such as an almost total absence of accounts created after 2016.
The network posting this spam consists of (at least) 1300 X accounts, almost all of which were created between 2010 and 2016. This is anomalous in and of itself, as organic discussions and trends on X (formerly Twitter) generally involve a mix of accounts created across the entire history of the platform. Many of these accounts have early personal-looking posts followed by lengthy gaps in their posting histories, suggesting that they were hijacked or purchased prior to being used for cryptocurrency spam.
Most of the content posted by this network is repetitive posts advertising various cryptocurrency tokens. These posts are frequently duplicated verbatim by multiple accounts in the network, and the network generally posts hundreds of posts featuring specific tokens in a rapid-fire fashion in an effort to cause the tokens in question to trend on X. Although the network occasionally tweets about major cryptocurrencies such as Bitcoin, Ethereum, and Dogecoin, many of the coins pushed are obscure meme coins such as $PEPE and $WEEBS.
In additional to the cryptocurrency spam, the accounts in this network also repost content rather prolifically. The accounts reposted by the network are mostly gaming-themed, with an emphasis on Counter-Strike: Global Offensive, but large accounts including Elon Musk, Binance, and Bleacher Report turn up as well. The posts amplified are a mix of videos, memes, and giveaway posts.
If you’ve made it this far, you won’t be surprised to learn that the accounts in this network make use of plagiarized profile images. Many are images that have been recycled and used for a variety of purposes across the internet for years. Other occurrences of these images were relatively easy to find with Google image search; TinEye proved less effective for this particular set of accounts.
Footnote: this analysis was originally performed a week ago; in the time since, X has suspended roughly half of the accounts in the network.