Overseas KOL Chaos: ZachXBT Exposes Million-Dollar Paid Promotion Traps

Authors: Umbrella & David, TechFlow

Original Title: A Showcase of Foreign KOLs’ “Rug Pull” Tactics: Clustering, Hype, and Concealment

On September 1st, when the market’s attention and liquidity were focused on Trump’s $WLFI, the well-known on-chain detective @ZachXBT started exposing scandals again.

He revealed a spreadsheet listing overseas KOLs who were paid to promote crypto projects on the X platform. The list included numerous accounts, with total payments exceeding 1 million USD; the price per post ranged from $1,500 to $60,000 depending on the KOL’s influence.

ZachXBT pointed out that among the KOLs on this list, fewer than five accounts labeled their promotional posts as “ads.” This means that for the vast majority of KOLs, when they publicly post on social media, you have no idea whether it’s a paid promotion or a genuine, spontaneous share.

Subsequently, another investigator @dethective further analyzed and organized the original spreadsheet, discovering even more creative tactics used by these overseas KOLs in paid promotions.

One Person, Multiple Accounts: Earning Double from Project Teams

In @dethective’s analysis, the first issue that stood out was that some wallet addresses appeared multiple times on the list.

This means that the same wallet could correspond to multiple KOL accounts, yet received promotional fees from the same project two or more times.

Take the accounts @Regrets10x and @lynk0x as examples. The list shows the former received $8,000 for four posts, while the latter received $12,000 for the same number of posts, possibly due to differences in follower count.

But their wallet addresses are exactly the same:

EKvYizd7LqTmMj4QqmKsHm8wdg7TXzFoHHg664FdnhCRh

After cross-referencing, blogger @dethective found that there were about 10 similar cases of duplicate wallets on the entire list.

One possible reason is that some overseas KOLs, in order to expand their influence, use alternate or related accounts for promotions but don’t bother to change wallet addresses, thus exposing their tracks.

But thinking deeper, whether out of laziness or negligence, not changing wallet addresses actually reflects a clustering hype strategy: multiple accounts posting about the same project at once makes it easier to dominate social media timelines and attention, thereby triggering FOMO among followers.

Of course, the two KOLs exposed in this case didn’t stay silent either.

@lynk0x denied receiving money in the comments, saying @Regrets10x was just a friend and the shared wallet was a coincidence. But @dethective quickly produced evidence:

The above wallet received $60,000 from an airdrop by a project called “Boop,” and to claim the airdrop, you must bind your X account. This indirectly proves the control relationship between the account and the wallet, making the denial untenable.

@Regrets10x’s response was more casual; he didn’t directly address the accusation but said as long as he disclosed paid promotions when posting, there was no problem.

It’s understandable to take paid promotions, and proper disclosure helps others understand the motives and interests behind posts. Some more professional KOLs often add a line like “related interests” or “no related interests” at the end of a post.

But the problem is, if two accounts belong to the same person and post the same promotional content, one openly labels it as an ad while the other stays silent, it looks more like a persona-building strategy using an account matrix.

Some even turn the practice of mass account promotion into an industry chain.

Previously, research institution DFRLab published a study titled “Anatomy of Crypto Scams on Twitter,” mentioning that some gray-market operators can control dozens of accounts, posting nearly 300 tweets daily. By mass account farming, automated retweeting and replying, and cross-endorsement, they create a false sense of public approval.

Operators usually buy old accounts or register new ones in bulk, change nicknames and avatars to create a “brand new” KOL, and then use scripts to copy the same promotional message into the comment sections of high-traffic tweets to “attract followers.”

“To The Moon”

After the list was exposed, another notable point was that the profits in these overseas KOLs’ wallets often overlapped highly with the tokens they promoted.

In other words, they weren’t just randomly sharing “insights,” but received tasks first, promoted the posts, and then traded themselves.

For example, the account @0xSweep, according to @dethective’s wallet analysis, made the most profit from several tokens on the BullX trading platform: $AETHER, $BOB, $BARSIK, etc.

But the backstory is that these tokens all had paid promotion records on the list exposed by ZachXBT; and @0xSweep’s X posts repeatedly mentioned them, claiming the tokens had great potential and could “to the moon.”

But his wallet records show that these profitable trades happened right before or after the promotions, making it highly likely that the project team paid him to post, and after the post boosted the token’s popularity, he traded to show activity.

This also means that if an account keeps telling you about their trading insights, their income may not actually come from trading or market judgment.

A similar case is @ShmooNFT. His Telegram channel promotes about 10 tokens daily, which at first glance looks like enthusiastic sharing.

But wallet tracking shows that his only profitable trades, such as $DEGE, $BON, $BOTIFY, were all promoted on X and appeared on ZachXBT’s exposed list.

The core issue with this model is that the KOL’s “advice” is biased: promotional posts are not labeled as ads, so fans think it’s a genuine recommendation, but it’s actually a paid partnership.

If the token really has potential, everyone’s happy, but if the promoted “shitcoins” go to zero, the KOL’s own credibility and influence will also decline.

The subtlety of this tactic is that these overseas KOLs may profit three times from it.

First, they get free tokens via airdrops, then collect promotional fees from the project, and finally sell the airdropped tokens after hyping up the price.

And a common advanced tactic: after building an image as a “trading god” by posting profit screenshots, they set up paid groups and charge “membership fees.”

Where There’s Demand, There’s a Market

At the end of the analysis post, dethective raised a thought-provoking question:

Why do some project teams still choose these accounts, even knowing the habits and tactics of some overseas KOLs?

The answer is: where there’s demand, there’s a market.

Some projects prefer audiences who “want to get rich quick,” and some of the accounts exposed earlier run channels and groups that perfectly attract this audience: those who lack independent research ability, trust calls and luck, and hope to discover an undervalued “golden dog.”

Often, such KOL accounts are defined as “more commercially valuable” in a marketing market where bad money drives out good.

Exposing scandals involves conflicts of interest and can easily cause trouble without reward; but if just one or two promoted tokens succeed, it’s easy to be sliced and spread as a “trading master.”

In a market where noise and truth are hard to distinguish, crypto investing is not as simple as following calls. There will always be bloggers who claim to always win, but lost funds will never return.