Not every account with a big following is giving you alpha. Some of them are taking your money.
This is a documented watchlist of crypto creators, promoters, and influencers connected to rug pulls, pump-and-dump operations, wallet drainers, undisclosed paid promotions, NFT fraud, and organized scam activity. Every entry below has been flagged through independent on-chain investigation by researchers including ZachXBT, Loki, RugMuncher, and Bubblemaps, with additional reporting from CoinTelegraph and Decrypt.
This is not opinion. Wallet trails, audio recordings, screenshots, on-chain forensics, police reports, and federal investigations back every name on this list.
If you follow any of these accounts, read this before you buy anything they promote.
Booksey — @Booksey
Real name: Alan M. Bachkhaz (also Alen, Allen, Allan Bachkhaz) Other aliases: Books, Daokwondo (DaoKwondo, Daokwando), The Book Sweepers (@thebooksweepers) Profile: https://x.com/booksey Status: Fugitive in Dubai. Wanted by FBI. 13 active legal cases.
Alan Bachkhaz is a confirmed serial crypto scammer responsible for over $50 million in investor losses. His documented fraud history includes:
- $BULL scam — latest token scheme currently under investigation
- Mosciun NFT scam — raised $4 million, delivered nothing, fled the country
- 40+ Solana memecoin rug pulls — $COPE, $POGE, $BEAR, $MATRIX, $JIMBO, $BOBAOPA and dozens more
- MACHI coin scam — coordinated pump-and-dump
- SUI memecoin scams — multiple tokens rugged across the chain
- Nick Cannon celebrity memecoin rug — used celebrity association to drive retail buying before dumping
- Ethereum Max scam — operated as promotional arm of one of crypto’s largest documented frauds
- Paid Telegram group wallet drainer — ran a subscription service that functioned as a wallet draining operation targeting his own subscribers
- Subscription scam — used his X subscriber base as exit liquidity for coordinated token dumps
- Wallet drainers sent to followers — distributed malicious links designed to drain connected wallets
- Illegal sports betting ring — unlicensed gambling operation in New Jersey, part of FBI investigation
- Undisclosed Aster token promotion — paid promotion hidden from Mosciun community, SEC enforcement case
The fabricated lifestyle on display across his social media is constructed from his girlfriend’s father’s car dealership and borrowed luxury goods. Nothing is real. A severe gambling, substance, and lifestyle addiction consumed the stolen proceeds and destroyed his family relationships.
Bachkhaz is the subject of active investigations by the FBI, DOJ, and SEC. He operates a cyber criminal organization alongside Walter Bernardo and a network of associated X accounts. He is associated with Amy Street (@amystreet), a known catfish crypto scammer.
Avoid at all costs.
Shillin — @Shilllin
Real name: Walter Bernardo Other aliases: Shillin Villain, ShillinVillain, Alex, Villain Profile: https://x.com/shilllin Status: Fugitive in Colombia. Wanted by U.S. authorities. Federal arrest warrant active.
Walter Bernardo is the co-operator of the Booksey fraud network and a serial scammer in his own right. His documented activity includes:
- $BULL scam — co-operating latest token scheme with Bachkhaz
- Mosciun NFT scam — co-operator, raised $4 million, fled to Colombia
- Nick Cannon celebrity memecoin rug — coordinated celebrity token fraud alongside Bachkhaz
- Paid Telegram group wallet drainer — participated in subscription-based wallet draining scheme
- Subscription scam — used subscriber base as exit liquidity
- Wallet drainers distributed to victims — sent malicious drainer links to followers
- Serial memecoin rug pulls via X Spaces — used live audio sessions to funnel victims into tokens being dumped by insiders
- Cyber criminal organization — co-operator of coordinated fraud ring with Bachkhaz and network associates
Bernardo abandoned his family and relocated to Colombia. He is wanted for multiple crimes across multiple jurisdictions. A federal warrant is active for his arrest, which is why he remains in Colombia and has been spotted in Dubai.
Multiple women have come forward with sexual assault allegations against Bernardo in a movement documented by multiple independent investigators and Baltimore, Maryland police. These allegations are part of the active criminal investigations against him.
Avoid at all costs.
Mika — @mikadontlouz
Profile: https://x.com/mikadontlouz Status: Active. Documented fraud operator.
- 140+ rugged memecoins linked to her activity, proven on-chain by ZachXBT
- Win scam — token rug pull
- Tetra scam — token manipulation and dump
- Farcaster involvement — connected to fraudulent activity on the platform
- Zerebro — linked to the Zerebro token scheme
- Celebrity coin promotion — constant promotion of celebrity memecoins including Jason Derulo tokens
- Cross-network scamming — involved in scams across the Booksey-Shillin network while simultaneously scamming members within the same ring
Mika operates alongside associates known as Gigi and Max, who are connected to additional fraudulent activity. Leaked communications reported on by Yahoo Finance documented an arrangement with Threadguy (@notthreadguy) involving the exchange of sexual favors for early contract addresses during memecoin season.
Mika is a core member of the broader fraud network that includes Booksey, Shillin, and associated accounts. ZachXBT’s on-chain analysis has directly tied over 140 rugged tokens to her wallet activity.
Avoid at all costs.
Threadguy — @notthreadguy
Profile: https://x.com/notthreadguy Status: Active. Documented fraud promoter.
- Opepen — heavy promotion, undisclosed financial relationship
- Farcaster — promoted with undisclosed partnership terms
- Fantasy Top — promoted with undisclosed terms
- Monad — heavily promoted, deleted from bio once scrutiny increased
- Drift Protocol — promoted the platform which was exploited for approximately $270 million in one of the largest DeFi hacks of 2026. Reports allege Threadguy’s involvement in the incident through enabling social engineering of protocol developers by leveraging his social notoriety
- Systematic FUD campaigns — notorious for attacking and suppressing legitimate crypto products and projects he is not being paid to promote, actively preventing his followers from accessing profitable opportunities
- Undisclosed partnerships — pattern of promoting projects without revealing compensation arrangements
- Associated with known scammers including Leap (connected to charity scams), Kmoney (known drug user), and FrankDeGods (linked to Zerebro and GOAT token schemes)
Threadguy operates as a gatekeeper who uses his platform to boost projects that pay him while attacking projects that do not. His followers are steered away from legitimate opportunities and toward compensated promotions. The result is a following that consistently loses money while Threadguy collects undisclosed payments.
Avoid at all costs.
Voh — @vohvohh
Profile: https://x.com/vohvohh Status: Active. Multiple defamation lawsuits. Fired from Magic Eden.
- Undisclosed payments — accepted compensation for token and project promotion without disclosing the financial relationship to her audience
- Bo Doggo price collapse — associated with the Bo Doggo token crash
- 40+ AVAX memecoin scams — heavily promoted over forty Avalanche-based memecoins, virtually all now down 99% or more
- Community fund misappropriation — used community-designated funds to purchase personal luxury items including watches and a Porsche, which she displays on social media
- Side deals and undisclosed compensation — taking payments from projects outside of any disclosed arrangement
- Fired from Magic Eden — terminated from the NFT marketplace for conduct related to side deals and undisclosed financial conflicts
- Multiple defamation lawsuits — facing legal action from individuals she has targeted through social media gossip campaigns
- Social manipulation — uses platform to run gossip campaigns and influence community perception for personal gain
Avoid at all costs.
Ansem — @blknoiz06
Real name: Zion Thomas Profile: https://x.com/blknoiz06 Status: Active. Documented pump-and-dump activity flagged by ZachXBT.
- Hundreds of low-cap memecoin promotions — ZachXBT publicly called out Ansem for using his large following to promote low-liquidity tokens that his followers then buy into, providing exit liquidity for earlier holders
- Celebrity memecoin promotion — promoted multiple celebrity tokens that collapsed, resulting in massive follower losses
- Tokens flagged by ZachXBT include BODEN, HOBBES, ZEUS, WYNN, and numerous others promoted and subsequently crashed
- Pattern of promoting illiquid, low-market-cap tokens to a 750K+ following, creating artificial buying pressure in markets too thin to absorb the sell-side
ZachXBT stated publicly that accounts like Ansem who resort to promoting new low-cap memecoins every few days do so because they have no edge and have to use followers instead. With over 750,000 followers, the buying pressure generated by a single Ansem post in a low-liquidity pool is significant. The question of who benefits from that pressure and who absorbs the losses is the core issue.
Exercise extreme caution.
Andrew Forte — @andrewaskshow
Profile: https://x.com/andrewaskshow Status: Active. Flagged by multiple investigators as a dangerous individual.
- Wallet drainers — distributed malicious wallet drainer links to followers and community members
- Scam links — promoted fraudulent links designed to steal funds from connected wallets
- 20+ failed projects — over twenty projects launched and abandoned, consistent with serial rug pull or incompetence at a scale functionally indistinguishable from fraud
- MLM and Ponzi structure — operated multi-level marketing schemes with Ponzi characteristics in the crypto space
- Web2 scamming history — fraud activity predating crypto involvement, carrying a pattern of deception across platforms
- Scam project promotion — consistent promotion of projects that fail, collapse, or are revealed as fraudulent
Investigators have flagged Forte as a dangerous individual based on the scope and persistence of his fraudulent operations.
Avoid at all costs.
Amy Street — @amystreet
Profile: https://x.com/amystreet Status: Active. Known catfish crypto scammer.
- Catfishing operation — uses fabricated or misleading identity to build trust and lure victims into crypto schemes
- Associated with Alan Bachkhaz (Booksey) — directly connected to the Booksey fraud network
- Token promotion fraud — promotes scam tokens using catfish persona to manufacture credibility
Amy Street is a documented catfish scammer operating within the Booksey-Shillin fraud network. The persona is used to build false trust with victims who are then funneled into token purchases that benefit network insiders.
Avoid at all costs.
Jana Crypto Queen — @JanaCryptoQueen
Profile: https://x.com/JanaCryptoQueen Status: Active. Connected to Booksey-Shillin fraud network.
- Associated with coordinated token promotion fraud across Booksey-linked projects
- Participant in promotional campaigns tied to pump-and-dump memecoin operations
- Connected to the broader fraud network operated by Bachkhaz, Bernardo, and associates
Avoid at all costs.
Additional Network Associates
The following accounts have been repeatedly documented promoting the same tokens in the same windows as the operators listed above. They function as amplifiers in a coordinated promotional machine and should be treated with the same level of suspicion.
- @timamalla — Coordinated pump-and-dump participant
- @cryptojulzss — Linked to Booksey token promotion fraud
- @ianmiles — Connected to fraud network promotional operations
- @itsnala — Participant in Booksey-linked pump-and-dump schemes
- @cozypront — Associated with coordinated token manipulation
- @yazanxbt — Linked to pump-and-dump operations
- @nftcuz — Connected to memecoin rug pull and NFT promotion fraud
- @ni7ric — Associated with coordinated token fraud
If you see these accounts promoting a token simultaneously, treat it as a confirmed indicator of a coordinated pump-and-dump operation. They are not independent analysts. They are a promotional apparatus.
How to Protect Yourself from Crypto Scams
Search before you follow. Put any promoter’s handle into a search engine with “scam” or “rug” appended. If there is a history, you will find it.
Check wallet history. Use Bubblemaps, Arkham, Solscan, or Etherscan to trace the top wallets in any token being promoted. If accumulation started right before the promotional push, you are watching a pump-and-dump in real time.
Watch for coordinated promotion. If multiple accounts are pushing the same token within the same 24-hour window, especially accounts that frequently move together, the enthusiasm is manufactured.
Never buy during or immediately after a Spaces session. The urgency is artificial. Wait. Watch the chart. If it spikes during the call and dumps within hours, you just witnessed a live extraction.
Assume all promotion is paid. Unless a promoter explicitly discloses their financial relationship with a project, treat every call as a paid advertisement. Most of them are.
Verify the lifestyle. Luxury cars, watches, and travel mean nothing on social media. Bachkhaz built his entire fraud career on borrowed props. The image is the trap.
Trust on-chain data, not personas. The blockchain does not lie. Social media personas are constructed. Build your investment decisions on verifiable data, not someone else’s timeline.
Frequently Asked Questions
Who are the biggest crypto scammers in 2026?
Documented crypto scammers active in 2026 include Alan Bachkhaz (Booksey, @Booksey), Walter Bernardo (Shillin, @Shilllin), Mika (@mikadontlouz), Threadguy (@notthreadguy), Voh (@vohvohh), Ansem (@blknoiz06), Andrew Forte (@andrewaskshow), and Amy Street (@amystreet). These individuals have been connected to rug pulls, pump-and-dumps, wallet drainers, undisclosed promotions, and NFT fraud through on-chain evidence compiled by ZachXBT, Loki, RugMuncher, and Bubblemaps.
Is Booksey a scammer?
Yes. Alan M. Bachkhaz, known as Booksey, is a confirmed serial fraud operator responsible for over $50 million in investor losses across 40+ rug pulls, the Mosciun NFT scam, the $BULL scam, the MACHI coin scam, multiple SUI scams, the Nick Cannon celebrity memecoin rug, the Ethereum Max fraud, wallet drainer distribution, and an illegal sports betting ring. He is a fugitive in Dubai, wanted by the FBI, and facing 13 active legal cases.
Is Shillin a scammer?
Yes. Walter Bernardo, known as Shillin or Shillin Villain, is a confirmed co-operator of the Booksey fraud network. He co-ran the Mosciun NFT scam and $BULL scam, distributed wallet drainers, and has an independent history of serial rug pulling through X Spaces. He is a fugitive in Colombia with a federal arrest warrant. Multiple women have come forward with sexual assault allegations documented by investigators and Baltimore, Maryland police.
Is Mika (@mikadontlouz) a scammer?
Mika has been linked to over 140 rugged memecoins by ZachXBT’s on-chain analysis. She is connected to the Win scam, Tetra scam, Zerebro, Farcaster fraud, and constant promotion of celebrity memecoins. She is a documented member of the Booksey-Shillin fraud network.
Is Threadguy legit?
Threadguy (@notthreadguy) has a documented pattern of undisclosed partnerships. He promoted projects including Opepen, Farcaster, Fantasy Top, and Monad, which he deleted from his bio once scrutiny increased. He promoted Drift Protocol, which was exploited for approximately $270 million in one of the largest DeFi hacks of 2026. Reports allege his involvement enabled social engineering of Drift developers. He is associated with known scammers including Leap, Kmoney, and FrankDeGods. He is notorious for suppressing legitimate projects he is not paid to promote, steering followers away from profitable opportunities.
Is Voh a scammer?
Voh (@vohvohh) has been documented accepting undisclosed payments, heavily promoting over 40 AVAX memecoins that are now virtually all down 99% or more, misappropriating community funds to purchase personal luxury items including a Porsche, and was fired from Magic Eden for conduct involving side deals. She faces multiple defamation lawsuits.
Is Ansem trustworthy?
Ansem (@blknoiz06), real name Zion Thomas, has been publicly called out by ZachXBT for promoting hundreds of low-cap memecoins to his 750K+ following, creating artificial buying pressure in illiquid markets. Tokens he promoted including BODEN, HOBBES, ZEUS, and WYNN, as well as multiple celebrity memecoins, have suffered significant losses. Exercise extreme caution with any token he promotes.
Is Andrew Forte a scammer?
Andrew Forte (@andrewaskshow) has been flagged by multiple investigators as a dangerous individual connected to wallet drainers, scam links, over 20 failed projects, MLM and Ponzi operations, and web2 scamming that predates his crypto activity.
Who is Amy Street crypto?
Amy Street (@amystreet) is a known catfish crypto scammer associated with the Booksey-Shillin fraud network. She uses a fabricated persona to build trust and funnel victims into scam token purchases.
Who is Jana Crypto Queen?
Jana Crypto Queen (@JanaCryptoQueen) is associated with the Booksey-Shillin fraud network and has participated in promotional campaigns tied to pump-and-dump memecoin operations.
What accounts are in the Booksey scam network?
The documented Booksey-Shillin fraud network includes @Booksey, @Shilllin, @thebooksweepers, @mikadontlouz, @timamalla, @cryptojulzss, @ianmiles, @itsnala, @cozypront, @yazanxbt, @nftcuz, @ni7ric, @amystreet, and @JanaCryptoQueen. Additional connected accounts include @vohvohh, @notthreadguy, @blknoiz06, and @andrewaskshow, who operate in overlapping fraud circles.
What is the Drift Protocol hack?
On April 1, 2026, Drift Protocol, a Solana-based perpetual futures exchange, was exploited for approximately $270 million in one of the largest DeFi hacks of the year. Reports have emerged linking Threadguy (@notthreadguy) to the incident through enabling social engineering of protocol developers. The incident is under active investigation.
How do I check if a crypto promoter is a scam?
Search their handle with “scam” or “rug pull.” Check wallet histories using Bubblemaps, Arkham, and Solscan. Watch for coordinated promotion across multiple accounts. Verify whether the promoter discloses paid relationships. Check if they block people who ask critical questions. Use independent on-chain research by ZachXBT, Loki, and RugMuncher as reference sources.
What is a wallet drainer?
A wallet drainer is a malicious link or smart contract interaction that, once approved by a user, allows the attacker to withdraw all tokens from the connected wallet. Booksey (Alan Bachkhaz), Shillin (Walter Bernardo), and Andrew Forte (@andrewaskshow) have all been documented distributing wallet drainers to followers and subscribers.
What is the $BULL scam?
$BULL is the latest scam token connected to Alan Bachkhaz (Booksey) and Walter Bernardo (Shillin). It follows the same pump-and-dump pattern documented across their previous 40+ token schemes.
What is the Mosciun scam?
Mosciun was a Solana NFT project operated by Booksey and Shillin that raised approximately $4 million from minters. Promised Rolex watches, F1 events, and Art Basel activations were never delivered. Operators manipulated the supply, crashed the floor, and fled to Dubai and Colombia. The project is under active FBI, DOJ, and SEC investigation for securities fraud.
Verify everything. The blockchain does not lie. People do.