Ava Labs COO’s X Account Suspected As Hacked After Posting Meme Coin

• The X account of Ava Labs’ operating chief, Luigi D’Onorio DeMeo, has been touting meme coins and other suspicious links, prompting many to warn it’s likely hacked in a phishing scam.

Ava Labs’ chief operating officer, Luigi D’Onorio DeMeo’s X account, is suspected of being hacked after posting about a newly launched Pokémon-themed meme coin and links to suspicious airdrops. 

Two of the posts on Aug. 19, which have now been deleted, shared the address to a Solana-based meme coin called Pika (PIKA) — styled after one of the media franchise’s central characters, Pikachu — in an apparent pump-and-dump scheme.

Many crypto users on X have posted warnings not to click or follow any links. 

“I’m an [Avalanche] maxi, but it’s inevitable that Solana is leading this bull market,” wrote one post from Demeo’s account. 

“Due to the increased search for meme coins, I’m creating the $PIKA token on Solana, based on my favorite character.”

It is not known how the possible attackers managed to breach DeMeo’s account and Ava Labs did not give any response about it yet.

PIKA’s market cap hit a high of $388,570 shortly after the posts from DeMeo’s account at around 1:40 am UTC, but it quickly fizzled out, falling over 99% to a current market cap of $3,289, according to DEX Screener.

DeMeo’s account has also posted links to suspicious websites claiming Ava Labs is giving away Avalanche (AVAX) tokens, inviting users to connect their crypto wallet. 

It also turned off comments to stem others’ warning of the scam, claiming there was the possibility of “malicious links” being shared.

The websites are stylized to mimic Ava Labs’ design but likely host a wallet drainer that steals all the crypto in a connected wallet.

X account “REKTBuildr” earlier reported that a link to a different scam website was shared by DeMeo’s account, which was later taken down.

They posted that the domain was registered 18 minutes before DeMeo’s account posted a link to it, estimating that it took attackers 30 minutes to register the domain, find hosting and breach DeMeo’s account to share the scam link.

The scam domain was registered 18 minutes ago

This is the fastest hack I've ever seen

They compromised @luigidemeo's account, registered a domain and set the hosting up all within the past 30 minutes pic.twitter.com/SySQm7DX1a

— REKTBuildr (@rektbuildr) August 18, 2024

Similar attacks have been carried out this year. In July, the X account of actress Sydney Sweeney was hacked to promote a crypto token using her likeness.