Starlink

A hacker allegedly used SpaceXAI and Starlink accounts on X to promote SCATMAN ⁠(SCATMAN), then extracted about $125,000 through a rapid token sell-off.
Key Points:
<ul>
 <li>Lookonchain linked two wallets to sales totaling 73.7 Ethereum ⁠(ETH), worth about $125,000 at the time.</li>
 <li>Screenshots appeared to show reposts from the SpaceXAI and Starlink accounts, but the companies had not confirmed a breach.</li>
 <li>The case follows a recurring pattern in which attackers exploit trusted social accounts to market newly created tokens.</li>
</ul>
SCATMAN Token Hack
On-chain tracker Lookonchain said the attacker <a href="https://beincrypto.com/spacex-starlink-scatman-rug-pull-hack/" rel="noopener noreferrer nofollow">minted</a> 10 trillion SCATMAN tokens after reportedly gaining control of the two accounts, then sold the full supply for 59 ETH, valued near $108,000.
A second wallet tied to the same operator sold another 59.28 million tokens for 14.7 ETH, worth about $27,000, bringing the combined proceeds to roughly $125,000.
The transactions moved quickly.
Screenshots circulating on social media appeared to show the SpaceXAI and Starlink accounts reposting material from the SCATMAN account, but those posts were no longer visible later.
BeInCrypto said it could not independently verify the alleged account compromises and had contacted SpaceX for comment, leaving the breach itself unconfirmed despite the traceable token sales.
Also Read: ⁠Bitcoin Whales Turn Bullish Near $60K While Spot Buyers Stay Missing
Crypto Scam Pattern
The episode reflects a familiar rug-pull method, in which attackers borrow the credibility of a recognized organization, promote a token to an existing audience and sell before account access is restored.
Lookonchain’s findings matter because the wallet activity provides a record of the sales, even though blockchain data alone cannot prove exactly how the social accounts were accessed.
Similar attacks have targeted crypto companies and public figures.
Hackers took over Pump.fun’s X account in February 2025 to promote a fraudulent PUMP token, while another compromised account belonging to former Malaysian Prime Minister Mahathir Mohamad was used in a scheme that reportedly stole $1.7 million.
The recurring sequence remains consistent across these cases: attackers seize a trusted channel, create urgency around a new token and convert buyer interest into a fast exit before warnings spread.
Read Next: ⁠France And Spain Turn $5.2B Across Polymarket And Kalshi Into A World Cup Pressure Cooker

SCATMAN Rug Pull Nets $125K After SpaceX And Starlink X Breach Claim

Yellow News

Other articles published on Jul 13, 2026

Join our free newsletter for daily crypto updates!