Incident case file

GOLD Token (Trump-Linked) Rug Pull / X Account Compromise — $330K Realized

Incident date Aug 28, 2026Last updated Sep 24, 2026

0 views

ContainedSolanaRug pull / social media account compromiseCluster: GOLDTOKEN-SOL-2026-08

Estimated loss

$330K

Affected users

Group joining is coming soon.

Investigation

30%

Facts and investigation

Ledger

Attacker

TODO — 15 wallets involved in the sell-off, no individual addresses publicly disclosed

Funds moved to

Approximately $330,000 was realized across 15 wallets selling GOLD tokens; a separate composite figure of $312K-8.2M covering both GOLD and a related PLATINUM token has been reported by GoPlus Security but not individually attributed.

Linked

Token mint: EMWtbpHaNqMbjUMZguuazhuZUVLWG3z4C5oZnGJPSqxS. Dev wallet: 3pQA1ZCaAuFgVJPmkxUGhBaDQjRpt88CXaXmoVy3. Malicious routing contract: FLASHX8DrLbgeR8FcfNV1F5krxYcYMUdBkrP1EPBtxB9. PLATINUM token: AuzcYsvKsYs1DFkQVzpm6tLzWb2fFSfZGxLHyubWY4jM. Funder of the 15 wallets: 5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9.

Chronology

1 beat

On August 29, 2026, a token marketed as GOLD, presented as linked to Donald Trump's digital asset ecosystem, was used in a rug pull enabled by a compromised social media (X) account. A cluster of 15 coordinated wallets sold GOLD tokens for a realized profit of approximately $330,000 (per on-chain analysis by Lookonchain), while GoPlus Security separately reported a combined profit figure across GOLD and a related PLATINUM token launch. A plausible compromise mechanism was identified by independent researchers: a WHOIS registration change on the relevant domain on August 29 potentially gave the attacker access to associated recovery emails, enabling an account password reset. Real Trump Coins officially denied any organizational involvement, attributing the incident to unaffiliated bad actors.

Sources and coverage

Articlex.comhttps://x.com/lookonchain

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)