Matt Furie, the artist behind Pepe the Frog, has again seen his X account used to promote a bundled memecoin, on-chain investigation platform Bubblemaps reported, marking at least the second time this year his account has pushed a freshly launched token before the post was framed as the result of a hack. Bubblemaps pointed to an April 14 incident where Furie's account promoted another bundled token before a similar hacking claim circulated afterward.
Bundled token launches typically involve a coordinated group of wallets buying a new token simultaneously at launch to inflate its apparent early demand, then selling into the volume generated by unsuspecting buyers who see a high-profile account's endorsement. Given the repeated pattern on Furie's account, Bubblemaps said many observers remain skeptical of the hacking explanation, and the platform opened a live case on its Intel Desk letting BMT token holders vote on whether Furie's account was genuinely compromised.
Related: Ravencoin Sheds 20% as Mining Pools, Not Core Team, Steer the Fix
Part of a Wider, Organized Operation
The incident fits a broader pattern on-chain investigator Specter has documented connecting Furie's account to hacks of at least two other high-profile X accounts, including Roaring Kitty's, within a five-week span earlier this year. Specter's tracing identified wallets holding more than $14 million in profits from an operation spanning five blockchains, Solana, BNB Chain, Ethereum, Tron, and Hyperliquid, that compromises high-follower accounts, deploys pre-bundled tokens on launch platforms like Pump.fun, extracts value in the 20-to-30-minute window before the promotional post is typically deleted, and launders proceeds through cross-chain bridges. The operation's infrastructure has been traced back to phishing activity dating to 2024.
Why the Repetition Undercuts the Hack Narrative
A single account compromise is plausible on its own. A second, similar incident from the same account months later, promoting the same type of bundled token, is what has pushed on-chain investigators toward treating the pattern as more than coincidence. Bubblemaps' Intel Desk case now lets the community weigh the evidence directly, using BMT token holdings to vote on the account's status rather than relying solely on the account's own explanation after the fact.
Whether or not Furie's account was compromised on either occasion, the incident underscores how the same bundled-launch playbook keeps working against high-follower accounts, and how difficult it has become for followers to distinguish a genuine hack from an account holder's own participation in a token promotion after the fact.
