Social-media impersonation scam spike
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when a sharp uptick in Discord, Telegram, or X (Twitter) accounts impersonating the protocol team or announcing fake airdrops, token migrations, or emergency wallet-connection prompts is detected. The signal is generated by social-media monitoring feeds tracking keyword-based impersonation patterns and verified-account impersonation on major platforms. Category 6 context: social-media impersonation scams are not structural exploits — they do not compromise on-chain contracts — but they are often paired with frontend phishing attacks and can serve as a distraction or amplification layer for a concurrent on-chain exploit.
Why it matters
Social-media impersonation spikes are documented as co-occurring signals in several dataset incidents. Badger DAO ($120M) saw impersonation and phishing activity concurrent with the frontend compromise. The Infini incident ($49.5M) involved a rogue developer with insider access, where social channels were a parallel attack vector. More broadly, fake airdrop scams have directly drained user wallets across dozens of smaller protocols. While the signal's connection to structural protocol risk is weaker than on-chain signals, a sudden coordinated impersonation campaign targeting a protocol is often a leading indicator of a coordinated attack across multiple vectors.
Green / Yellow / Red
Green is the baseline when social-media monitoring shows no unusual pattern of impersonation accounts or fake-airdrop announcements related to the protocol. Yellow fires when a moderate increase in impersonation accounts is detected — consistent with a targeted phishing campaign but without evidence of coordinated escalation. Red fires when a sharp spike in coordinated impersonation activity is detected across multiple platforms simultaneously, particularly if the messaging is consistent with a specific false announcement (token migration, emergency wallet reconnection) that could trigger user wallet-connection actions.
Common gray cases
Gray applies when the social-media monitoring feed does not cover a platform where the protocol's community is primarily active, or when the protocol does not have a significant social media presence making baseline-setting unreliable.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect a sharp uptick in Discord/Telegram/X accounts impersonating the protocol team or announcing fake airdrops.