Robinhood CEO X breach suspected as fake VLAD token nets $1.3M

Robinhood CEO X breach became the focus of attention after an unauthorized post appeared on Robinhood CEO Vlad Tenev’s X account, promoting a fake memecoin called VLAD and sharing what was later identified as a fraudulent token contract.

The post remained visible for less than 20 minutes, attracting more than 175,000 views before users flagged it as suspicious. Robinhood later confirmed the account had been compromised and said it was working with X to restore access while removing the unauthorized content.

On-chain monitors estimated that wallets tied to the incident extracted about 650 Ether, valued between $1.2 million and $1.3 million.

Robinhood CEO X Breach Led to Fake VLAD Token Promotion

The unauthorized post claimed VLAD was Robinhood Chain’s official mascot token and included a contract address for users to purchase it. It also stated that the token would be listed on Robinhood’s trading platform, although Robinhood made no such announcement.

Onchain Lens first reported the account compromise. Robinhood Chain’s blockchain explorer later marked the contract as a scam. Robinhood confirmed the incident through its Robinhood Comms account, stating that it was coordinating with X to regain access while the post had already been removed.

According to on-chain monitor MLM, wallets associated with the incident extracted about 650 ETH, worth roughly $1.2 million to $1.3 million. Wu Blockchain also shared the reported findings.

An online investigator using the name Jeff said a wallet believed to be linked to the attackers spent about $126.81 to purchase 47.2 million VLAD tokens. Based on quoted market prices at the time, the holding showed an unrealized value of approximately $159,000.

However, the estimate did not indicate that the full amount could have been sold because liquidity for scam tokens is often limited.

Robinhood CEO X Breach Highlights Robinhood Chain Activity

The fake promotion came shortly after Robinhood Chain‘s release on July 1. The blockchain is built as an Ethereum Layer 2 (L2) network using the Arbitrum Orbit stack, handling approximately 6 million transactions per day and accommodating both tokenized real-world assets and vibrant memecoin trading.

Blockchain data revealed the fraudulent token had about 1,868 transactions shortly after it was deployed by a contract called PonsLaunchFactory, which was later flagged as a scam by the blockchain explorer.

The incident also coincided with the announcement that Robinhood Chain would launch V2, one of the token launch platforms on the crypto chain.

The roadmap features an ETH-based bonding curve, integration with Uniswap V4, creator payouts in ETH or selected assets, support for custom trading pairs corresponding to assets like USDG, AAPL, NVDA, and HOOD, and optional reflection token features, to name a few.

The site claimed that the new contracts are still being audited and haven’t been implemented yet.

Attack Shows Continued Focus on Social Media Compromises

The illegal post was live for a brief time, but transaction data showed continued interaction with the token before its removal. The message was based on the activity of Robinhood Chain memecoins and had the false claim of an official token listing to draw in buyers.

The incident adds to a series of attacks where compromised social media accounts have been used to promote fraudulent tokens or publish malicious contract addresses. While some types of phishing attacks have seen losses diminish, others have escalated into cryptocurrency fraud, security researchers say.

If you're reading this, you’re already ahead. Stay there with our newsletter.