Watcher Guru Hacked, False Ripple-SWIFT Deal Posted

On March 21, at 2:05 A.M. UTC, the official X account of Watcher Guru, a well-known crypto and finance media outlet, was compromised. The hacker posted a fraudulent update claiming that SWIFT was in the final stages of finalizing a deal with Ripple to utilize XRP for global payments. The post, which included a link to a seemingly official source, was swiftly deleted by Watcher Guru's team after they detected the unauthorized activity. The platform promptly issued a warning to its followers, confirming the hack and assuring them that they were investigating the incident. Watcher Guru emphasized that they had two-factor authentication enabled and had implemented stringent security measures to prevent such breaches. Despite these precautions, the hacker managed to exploit the platform's auto-reposting feature, which automatically shares "JUST IN" or "BREAKING" news from X to other platforms like Telegram, facebook, and Discord. This allowed the misleading information to spread rapidly before it was taken down.

The incident raised concerns about broader security vulnerabilities within the crypto community. Watcher Guru noted that the breach bore similarities to a previous hack targeting a prominent crypto influencer, highlighting the persistent risks even with robust security measures in place. The platform has since cleaned up all fake posts and locked down their account to prevent further unauthorized access. The exact method and origin of the hack remain under investigation.

The timing of the hack coincided with SWIFT's announcement about the rollout of smooth crypto payments on the same day, leading to speculation among some users. There is no concrete evidence to support the theory that Watcher Guru had insider information, but the coincidence has fueled discussions about the possibility of the hack being used as a cover for an unintentional leak. Watcher Guru has not provided any further details on the investigation or the potential source of the breach. The incident serves as a stark reminder of the ongoing risks associated with social media hacking and the importance of vigilance in the crypto community.

Watcher Guru believes the breach may have started weeks earlier as its team had received a suspicious X link through Telegram on March 5. The team flagged the link and contacted X’s Head of Cybersecurity, but received no reply. The link was formatted in a strange way, using X’s official domain but including a specific path and ‘token’ query string which X links do not normally have. Watcher Guru stated that its account, like DB News, another crypto media outlet, had two-factor authentication enabled, no connected apps, and no API tokens were used to post the false information. The firm noted that its breach resembled that of DB News, another crypto media outlet. The exact source or method behind the hack has not yet been determined, and Watcher Guru is contacting X for further clarification.

This incident marks the second major breach of a prominent crypto platform on X. Earlier this week, another crypto media outlet's X account was hacked and used to spread false information. The hacker also blocked Ripple’s official X account and that of its CEO to presumably slow down a ‘false report’ response from their team. The unauthorized post quickly gained attention and sparked excitement in the XRP community, with many users believing it was true. For context, a prominent pro-XRP crypto exchange mistakenly shared the fake news, amplifying the confusion. Shortly after, Watcher Guru clarified the situation, confirming that the post did not come from their team. The post falsely stated that Ripple would soon partner with SWIFT and that billions of XRP had been locked in escrow as liquidity reserves. The post was deleted, and Watcher Guru assured its followers that they were investigating the incident. The team has taken extreme measures to avoid hacks and has 2FA enabled. The incident highlights the need for increased security measures and vigilance in the crypto community to prevent such breaches in the future.