By Umbrella & David, TechFlow

On September 1, while market attention and liquidity were focused on Trump's $WLFI, renowned on-chain investigator @ZachXBT began another exposé.

He revealed a spreadsheet listing overseas KOLs who had been paid to promote crypto projects on X. The list documented numerous English-speaking KOLs receiving compensation for promotional posts, involving many accounts with total payments exceeding one million dollars; individual post fees ranged from $1,500 to $60,000 depending on the KOL’s influence.

ZachXBT pointed out that fewer than five accounts in the list marked their promotional posts as "ad," meaning most KOLs made public social media posts without disclosing whether they were paid promotions or genuine personal recommendations.

Shortly after, another sleuth @dethective conducted further analysis and organization of the original spreadsheet, uncovering even more elaborate tactics used by these overseas KOLs in paid promotions.

Multiple Accounts, Double Payments

In @dethective's analysis, one of the first red flags was the repeated appearance of identical wallet addresses in the list.

This suggests that a single wallet may be linked to multiple KOL accounts, each receiving separate promotion fees from the same project—sometimes twice or more.

Take @Regrets10x and @lynk0x as examples. The list shows the former received $8,000 for four posts, while the latter received $12,000 for the same number of posts—possibly due to differing follower counts.

Yet both share the exact same wallet address:

EKvYizd7LqTmMj4QqmKsHm8wdg7TXzFoHHg664FdnhCRh

After cross-referencing, blogger @dethective found around ten similar cases of duplicated wallets across the entire list.

One possible explanation is that some overseas KOLs use secondary or affiliated accounts to amplify reach during promotions but failed to switch wallet addresses, leaving detectable traces.

But looking deeper, whether due to laziness or oversight, not changing wallet addresses actually reveals coordinated amplification—posting from multiple accounts under the same project increases visibility on social media timelines and captures more attention, triggering FOMO among followers.

Naturally, the KOLs exposed didn't stay silent.

@lynk0x denied receiving any payment in the comments, claiming @Regrets10x was merely a friend and the shared wallet was pure coincidence. However, @dethective quickly presented evidence:

The aforementioned wallet claimed $60,000 from an airdrop by a project called "Boop." To qualify for the airdrop, users must bind their X account—effectively proving control over both the account and wallet, making denial implausible.

@Regrets10x responded more casually, avoiding direct answers and stating that paid promotions are acceptable as long as disclosed in posts.

Accepting sponsorships isn't inherently wrong, and proper disclosure helps audiences understand motivations and conflicts of interest. More professional KOLs often add notes like "disclosure" or "no conflict" at the end of posts.

However, if two accounts belong to the same person, and only one discloses the promotion while the other stays silent about identical content, this resembles a persona-building strategy using an account matrix.

Even worse, some have turned bulk account promotion into an industrialized operation.

Previously, research group DFRLab published a study titled "Anatomy of a Twitter-Augmented Crypto Scam", revealing how certain gray-market operators control dozens of accounts to post nearly 300 tweets daily. They create false impressions of popularity through mass account farming, automated retweeting and replies, and mutual endorsements.

Operators typically acquire old accounts or register new ones in bulk, then change usernames and profile pictures to pose as fresh KOLs. Using scripts, they copy identical promotional messages into high-traffic tweet comment sections to "gain followers."

"To The Moon"

Another notable finding after the leak was that the wallets of these overseas KOLs showed profits highly correlated with the tokens they promoted.

In other words, they weren’t randomly sharing “insights,” but rather promoting tokens they’d been paid to push—and trading them afterward.

For instance, @0xSweep’s largest profits came from tokens like $AETHER, $BOB, and $BARSIK on the BullX exchange, according to @dethective’s wallet analysis.

The backstory: all these tokens appear in ZachXBT’s leaked list as having paid promotion records. @0xSweep repeatedly mentioned them on X, praising their huge potential and moonshot prospects.

Wallet records show his profitable trades occurred precisely around the time of promotion—strongly suggesting he was paid by the project, boosted hype via posts, then profited personally from rising prices.

This implies that when an account keeps giving you trading advice, their income might not come from trading or market analysis at all.

A similar case is @ShmooNFT, whose Telegram channel promotes around ten tokens daily—appearing at first glance like helpful sharing.

Wallet tracking, however, reveals that his only profitable trades—such as $DEGE, $BON, and $BOTIFY—were all previously promoted on X and included in ZachXBT’s exposure list.

The core issue here is that KOL "recommendations" contain hidden agendas: promotional posts lack disclaimers, so fans believe they’re authentic endorsements when they’re actually paid collaborations.

If the token truly has potential, everyone wins. But if it’s just pump-and-dump schemes ending in zero value, the KOL’s credibility and influence will eventually erode.

The sophistication lies in the fact that these overseas KOLs may earn triple revenue:

First, acquiring free tokens via airdrops; second, charging project teams for promotion; third, inflating prices through hype and then selling off their airdropped holdings.

A common advanced tactic: showcasing trades and profits to build a "trading god" image, then monetizing through paid groups charging membership fees.

Demand Creates Market

At the end of his analysis thread, dethective raised a thought-provoking question:

Why do some project teams still choose these KOL accounts, even knowing their habits and套路?

The answer is simple: where there’s demand, there’s a market.

Some projects specifically target audiences eager for quick wealth. The channels and groups run by the exposed KOLs perfectly attract such users—those lacking independent research skills, more inclined to trust hype calls and luck, always chasing the next undervalued gem.

In a marketing landscape where bad actors drive out good ones, these KOLs are often deemed "more commercially valuable."

Exposés involve conflicting interests and often backfire. Yet if just one or two promoted tokens succeed, the KOL can easily be reshared across platforms as a legendary trader.

In a market filled with noise and obscured truths, crypto investing isn’t as simple as following someone’s trade call. There will always be eternally profitable influencers—but lost funds never return.