Matt Furie

<ul>
 <li>The RoaringKitty X hack on May 11 generated $600K+ profit via a bundled $RKC Solana memecoin dump.</li>
 <li>Specter linked 12 wallets holding $14M+ to prior bundled token scams including $USOR and $VDOR.</li>
 <li>The Matt Furie and WinRAR X hacks are tied to the same group through shared fee and bridge wallets.</li>
 <li>The threat group spans phishing, memecoin fraud, KOL payments, and serial X account compromises.</li>
</ul>
A coordinated threat group <a href="https://blockonomi.com/court-blocks-arbitrum-dao-from-releasing-71-million-in-hacked-ethereum/" rel="noopener noreferrer nofollow">h</a><a href="https://blockonomi.com/court-blocks-arbitrum-dao-from-releasing-71-million-in-hacked-ethereum/" rel="noopener noreferrer nofollow">acked</a> the X account of @TheRoaringKitty on May 11, launching a Solana memecoin that briefly hit a $12 million market cap. The attacker used multiple bundled wallets to sell into the pump, netting over $600,000 in profit.&nbsp;
On-chain investigator Specter traced the funds through bridges, swaps, and cross-chain transfers. The same group is now linked to two other major X account breaches and over $14 million in memecoin scam proceeds.
<h2 id="b-roaringkitty-hack-tied-to-serial-memecoin-bundling-operation-b">RoaringKitty Hack Tied to Serial Memecoin Bundling Operation</h2>
The hacker promoted a token called $RKC through the compromised account before deleting the post. Specter identified eleven wallet addresses connected to the attack.&nbsp;
Most profits moved to a <a href="https://coincentral.com/shiba-inu-exchange-supply-falls-as-expert-rejects-new-investor-warnings/" rel="noopener noreferrer nofollow">centralized exchange</a>. Around $220,000 was bridged and converted into Monero via Wagyu on Hyperliquid. Another $4,000 moved across Tron wallets.
Tracing one Tron wallet led back to an Ethereum address and a Solana wallet. That Solana address connected to prior token launches including $USOR, $VDOR, $DROID, $WCOR, and $UGOR.&nbsp;
According to Specter’s investigation, $USOR reached a $200 million market cap. $VDOR hit $45 million before collapsing. Charts confirm both were bundled scam launches.
Twelve additional wallets holding over $14 million in profits were uncovered. These tokens were promoted heavily across Telegram, X, Instagram, TikTok, and YouTube.&nbsp;
The same group of paid influencers promoted every launch. Specter noted these were cheap KOLs who used their audiences as exit liquidity.
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 An investigation into the <a href="https://twitter.com/TheRoaringKitty?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@TheRoaringKitty</a> and <a href="https://twitter.com/Matt_Furie?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Matt_Furie</a> X account hacks. The group behind the hacks has made eight figures from previous bundled and pump token launches.
 I uncovered wallets holding $14M+ in funds and linked some of their past crimes. <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f9f5.png" alt="🧵"><a href="https://t.co/wMmWnEKVp0" rel="noopener noreferrer nofollow">pic.twitter.com/wMmWnEKVp0</a>
 — Specter (@SpecterAnalyst) <a href="https://twitter.com/SpecterAnalyst/status/2055268971918586318?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 15, 2026</a>
 </blockquote>
</div>
<h2 id="b-matt-furie-and-winrar-breaches-traced-to-the-same-group-b">Matt Furie and WinRAR Breaches Traced to the Same Group</h2>
One of the $RKC bundled wallets bridged funds from <a href="https://parameter.io/bnb-crashes-through-600-support-as-geopolitical-turmoil-shakes-cryptocurrency-markets/" rel="noopener noreferrer nofollow">BNB Chain</a>. That wallet previously received fees from a Pepe token launched through bnbshare[.]fun during the April 14 hack of @Matt_Furie’s X account. This connection links both hacks to the same operation.&nbsp;
Specter also traced the May 4 @WinRAR_RARLAB breach to this group via a shared fee wallet.
The bnbshare[.]fun platform was developed by a user identified as @aliasbacardi. Fee revenue routed to a specific Ethereum wallet. That wallet bridged funds to a Solana address directly connected to the RoaringKitty hacker wallets.&nbsp;
By the time the investigation surfaced, all posts on @aliasbacardi’s account had been deleted.
The group’s activity extends back to 2024 phishing operations. One linked wallet facilitated a signing attack that drained $2.45 million in <a href="https://moneycheck.com/why-lido-picked-chainlink-ccip-to-secure-20b-in-wsteth/" rel="noopener noreferrer nofollow">wstETH</a> from a victim.&nbsp;
Specter flagged transfers in March 2026 connecting current wallets to that earlier theft. The group has cycled through phishing, bundled token launches, influencer payments, and account hacking.
Specter called out X’s @nikitabier, urging a review of the three known account compromises within a single month. A similar pattern of coordinated X account hacks occurred in 2022 and 2023, previously documented by researcher @ZachXBT.
The post <a href="https://blockonomi.com/hackers-behind-roaringkitty-x-breach-linked-to-14m-memecoin-scam-network/" rel="noopener noreferrer nofollow">Hackers Behind RoaringKitty X Breach Linked to $14M Memecoin Scam Network</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Hackers Behind RoaringKitty X Breach Linked to $14M Memecoin Scam Network

Table of Contents

Blockonomi

Other articles published on May 15, 2026

Join our free newsletter for daily crypto updates!