The Amsterdam Ghost: Irish Police X Accounts Hijacked for XRP Phishing and the Web2 Trust Anchor Crypto Still Can't Replace

Wednesday night. Somewhere in the dead zone between the close of European cash markets and the first flicker of Asian desks, two X accounts belonging to An Garda Síochána — the national police service of Ireland — stopped being police accounts. GardaTraffic, roughly 600,000 followers. GardaInfo, roughly 300,000. Combined institutional reach: approximately 900,000 people. The blue verification badge — the small glyph that X issues to signal "this is the real institution, this is the official voice" — was stripped from both profiles. The location field was rewritten to Amsterdam. And then the posts began. "Claim your XRP allocation." We didn't get a press release. We didn't get a statement from the platform. We got a screenshot at 02:14 CET from a trader in my copy-trading community who typed four words and a question mark: "Is this real?" That question — not the hack — is the actual event. Because 900,000 people were forced to make the same binary decision in the same window, with the same incomplete information, and the entire trust architecture of this industry collapsed into a single question mark. Speed is the only alpha that doesn't decay. But speed applied to a lie is just a faster way to zero. Here's what we actually know. Here's what we can reasonably infer. And here's what you need to do about your own wallet before the next one. This is not a market event. It's a structural one, and it's been repeating for five years. Let me set the table properly, because the headlines are already mangling this into something simpler than it is. An Garda Síochána is Ireland's national police and security service. It operates a network of official X accounts for public communication — traffic advisories, missing persons alerts, road closures, incident updates, public safety notices. Two of those accounts, GardaTraffic and GardaInfo, were compromised on a Wednesday evening. The attacker gained sufficient control to remove the platform's institutional verification badge, alter the profile location to Amsterdam, and publish cryptocurrency promotional content — specifically an "XRP allocation" claim — designed to funnel users toward a phishing flow. The source reporting confirms the incident, the affected accounts, the timeline, the badge removal, the location change, and the crypto content. It does not disclose the intrusion vector. That gap is where the real analysis lives. This is not the first time. It will not be the last. In July 2020, a coordinated attack compromised more than 130 high-profile X accounts — Barack Obama, Apple, Elon Musk, Bill Gates, Joe Biden, Kanye West, and dozens of corporate accounts — in what was fundamentally a Bitcoin giveaway scam. The attackers used internal tooling access. In 2022 and 2023, the SEC's own X account was briefly compromised to post a fake Bitcoin ETF approval — a post that moved the market for minutes before being debunked. In 2024, multiple government and corporate accounts fell to the same class of attack. The pattern is not new. What's new is the frequency, the professionalism, and the fact that we keep treating each instance as a discrete news event rather than as a symptom of a structural failure that nobody is fixing. Here's the thing that should bother you more than the hack itself. Crypto's trust architecture is built on top of Web2 identity. When a protocol wants to announce a partnership, it posts on X. When a foundation wants to announce a token migration or a contract upgrade, it posts on X. When an exchange wants to announce a listing, it posts on X. When a government wants to warn about a scam, it posts on X. The verification badge — that small blue check — functions as the de facto root certificate for the entire information layer of this industry. And that root certificate was just forged, stripped, and reused in under six hours. I've been in this market since 2017, and I've paid tuition for every lesson. I lost 70% of my capital in the ICO crash of early 2018 because I trusted narratives instead of liquidity depth. I ran a Python arbitrage script during DeFi Summer 2020 that executed over 400 trades in a single weekend and netted €2,300 before gas fees ate the edge — and that experience taught me that code-based execution beats human intuition when the window is measured in blocks. I watched Terra/Luna implode in 2022 and pulled a fund's stablecoin exposure based on on-chain reserve data before the official announcement landed. Every one of those lessons pointed to the same conclusion: verify the chain, not the claim. And yet here we are, in 2025, still treating a blue check as a signature. The Irish police hack is not about Irish police. It's about the fact that we never actually solved the identity problem. We rented a solution from a company that can't reliably protect its own users, and we've been pretending the rental is ownership ever since. Now the technical part. Let me walk through the attack surface, the evidence, and what the attacker's operational choices tell us about who they are and what they're capable of. High-profile account takeovers on X — and historically on Twitter — follow a limited number of technical paths. Ranked by observed frequency over the last three years, from most common to least. One. OAuth token and session token theft. This is the dominant vector, and it's the one most people underestimate. An infostealer malware family — RedLine, Raccoon, Lumma Stealer, and their many descendants — infects a device that holds an authenticated session with X. The malware exfiltrates the session cookies. The attacker imports the cookie into their own environment, and the platform sees a valid, authenticated, logged-in session. Password is irrelevant. Two-factor authentication is bypassed entirely, because the platform isn't asking for a password or a code — it's reading a cookie that says "this user is already logged in." This is how the majority of modern high-profile hacks actually happen, and it's the reason that "I have 2FA" is not a security answer. Two. SIM swap. The attacker socially engineers the victim's mobile carrier into porting the victim's phone number to a SIM card the attacker controls. Any SMS-based two-factor code then routes to the attacker's device. This vector is declining in effectiveness as platforms move toward app-based and hardware-based authentication, but it remains common in institutional environments where the phone number is the account recovery channel. If your account recovery runs through a phone number, you have a SIM swap exposure, full stop. Three. Credential stuffing. Password reuse. The attacker takes a leaked credential dump from some unrelated breach and tries the same email and password combination across platforms. If the account owner reused a password, the account falls. This is crude, but it still works at scale because humans reuse passwords, and because institutional accounts are often shared across multiple staff members, multiplying the reuse surface. Four. Third-party application compromise. Scheduling tools, social media management dashboards, analytics integrations, link shorteners. If the account has granted OAuth scopes to a third-party application, and that application is compromised, the attacker inherits the account's posting or management permissions without ever touching the primary credentials. The 2020 Twitter hack exploited internal tooling; the broader category of third-party integration compromise is a persistent and under-audited risk. Five. Insider threat and targeted phishing. A directed phishing campaign against the social media operator — a fake login page, a spoofed platform notification, a "your account has been flagged" email — or a malicious insider with legitimate access. The source reporting does not disclose which path was used. But the evidence — specifically the badge removal and the profile modification — narrows the field considerably. The institutional verification badge is not a cosmetic element. On X, removing or altering verification status typically requires a level of account access beyond simple posting permissions. If the attacker could strip the badge and rewrite the profile location, they had administrative or near-administrative control of the account. That is not a "someone guessed the password" scenario. That is a session-level or account-level compromise. Think about the distinction. Posting-only access is one thing — a compromised scheduling tool might grant exactly that. But profile modification, verification changes, and credential-level control indicate the attacker either possessed a fully authenticated session token, or had account recovery access, or compromised an admin-level third-party integration. The first — session token theft — is the most likely. And this is the single most important fact for anyone running an institutional account: your two-factor authentication does not protect you against cookie theft. Your password does not protect you against cookie theft. Only device hygiene, active session management, and hardware-bound authentication do. If an infostealer lands on a device that holds a live session, the attacker walks through the front door wearing your face. The attacker changed the account location to Amsterdam. I want to be careful here, because location fields are weak signals and it's easy to over-read them. Three interpretations, in order of my confidence. Low confidence: Amsterdam is the attacker's actual physical location. Possible, but professional operators rarely volunteer their real geography, and the location field is trivially editable. Low confidence: Amsterdam is a proxy or VPS endpoint. The Netherlands hosts enormous data center capacity — Amsterdam is home to AMS-IX, one of the largest internet exchange points on the planet. An attacker routing traffic through Dutch infrastructure would appear to originate from Amsterdam. Plausible, but not informative; half the internet appears to originate from a handful of European data centers. Moderate confidence: Amsterdam is deliberate misdirection. Setting the location to a specific European city plants a false trail. If the attacker's real location is elsewhere — Eastern Europe, Southeast Asia, West Africa — writing "Amsterdam" shifts investigative resources toward the Netherlands and away from the actual source. Here's the part that matters regardless of which interpretation is correct: the location change itself is evidence of full profile control. A posting-only compromise cannot alter the location field. The attacker had administrative access. That's the forensic fact, and it's more reliable than the geographic content of the field itself. The attack occurred on a Wednesday evening. This is not random. Institutional social media operations — especially government accounts — are staffed during business hours. Evening and overnight windows have reduced monitoring, slower incident response, and a larger gap between the malicious post going live and the account being locked down. The attacker's goal is exposure time: the phishing post needs to be live long enough to capture clicks, but not so long that the platform and the institution respond. Wednesday night, European time, sits in a narrow sweet spot. European staff are offline. US staff are mid-afternoon — technically available, but not necessarily monitoring a European police account. The attacker has a window of a few hours before morning shift coverage kicks in and the account gets locked. This is operational discipline. It's the same logic a trader applies to illiquid markets: you execute when the book is thin, not when it's deep. The attacker is running an execution strategy, and the target is attention. The phishing content claimed users could "claim an XRP allocation." This is a textbook airdrop phishing pattern. The mechanics, step by step. The victim sees a post from a "verified" institutional account announcing a token distribution. The victim clicks a link. The link leads to a site that requests a wallet connection. The wallet connection requests a signature or an approval — often a token approval, a permit2 signature, or a "sign to claim" transaction. The signature grants the attacker spending rights over the victim's tokens, or the "claim" transaction drains the wallet directly. The choice of XRP is deliberate, and it's audience selection. XRP has a large, active, retail-heavy holder base. The XRP community has a documented sensitivity to "official distribution," "partnership," and "allocation" narratives — a sensitivity rooted in the asset's long legal history and the community's siege mentality. Historically, XRP holders have been targeted by a wide range of scams that leverage the asset's brand recognition. Choosing XRP over BTC or ETH is fishing in a pond where the fish have been conditioned to respond to allocation language. It's not random. It's a targeted marketing decision. There's a darker read here too. The repeated use of XRP as scam bait creates a slow, ambient brand association — "XRP equals the thing scammers use." I don't think this has measurable price impact; the correlation is too diffuse. But it's a real, if minor, reputational tax on the asset, and it's paid by holders who did nothing wrong. Every time a scammer picks XRP as the lure, they're implicitly telling the market that XRP holders are the easiest marks. That's an ugly thing to be told about your community, and it's unfair, and it's happening anyway. Some of the malicious posts were flagged by the platform. That's the good news. The bad news is that the flagging happened after the posts were published. This is the fundamental architecture of platform trust and safety: reactive moderation. Content goes live. Then it gets reviewed. Then it gets flagged or removed. The window between publication and enforcement is where all the damage happens. For an attacker, that window is the entire business model. You don't need the post to survive for a day. You need it to survive for the twenty minutes it takes a fraction of a percent of 900,000 followers to click and sign. Run the math. If 0.1% of followers interact — 900 people — and 10% of those sign a malicious approval, that's 90 compromised wallets. At an average of a few hundred dollars each, that's tens of thousands of dollars extracted in a single evening from a single account pair. And if the attacker runs this play across multiple accounts, in multiple countries, the aggregate is a functioning business. This is why the post-event flagging model is insufficient. It's a cleanup crew, not a security guard. The platform's incentive is engagement, and its moderation capacity has been reduced over time. The result is that the enforcement always lags the exploit, and the attacker only needs the lag to be long enough for a fraction of a percent to act. Account takeover for crypto phishing is not a solo operation. It's an industrialized supply chain with specialized roles, pricing, and repeat customers. At the top of the chain, credential harvesters operate infostealer malware campaigns that collect session cookies and credentials at scale. These are commodity operations — malware-as-a-service kits sold on underground forums, with subscription pricing and customer support. In the middle, access brokers serve as middlemen, validating compromised account access and selling it to the highest bidder. A verified government account with 600,000 followers is a premium asset on these markets. Access to a high-trust institutional account can sell for thousands of dollars, because the conversion rate on phishing from a trusted source is orders of magnitude higher than from an anonymous account. Below that, phishing kit developers build the fake claim pages, wallet drainers, and approval exploits. This is modular work. The same drainer kit gets reused across dozens of campaigns, with cosmetic changes to the front end. Then the distribution operators — the people who actually post from the compromised account and manage the funnel. This is where the Irish police hack sits. The attacker didn't need to build the phishing kit or launder the money. They needed access to a high-trust account and the operational security to use it before detection. Finally, cash-out infrastructure: mixers, cross-chain bridges, and exchange deposit accounts used to launder the proceeds. The final hop is usually a centralized exchange deposit address, which is the choke point where law enforcement can theoretically intervene — if the exchange cooperates and if the funds haven't already moved. This is the part that the "hack" framing obscures. The event is not a technical failure of X's security alone. It's a functioning criminal economy with division of labor, pricing, and repeat customers. The Irish police accounts were a product being sold and consumed, not a one-off exploit. Underneath the technical analysis is a governance problem that nobody wants to name: public-sector operational security is underfunded and under-staffed. A national police force's social media accounts are, functionally, a public trust interface. They're used to communicate during emergencies. They carry institutional credibility. And they are, in most cases, operated by small communications teams with standard consumer-grade security practices: password plus SMS two-factor, shared credentials, third-party scheduling tools, no hardware keys, no session monitoring, no alerting on anomalous login locations. I've audited operational security practices across small trading operations, and the failure modes are depressingly consistent. Shared logins stored in spreadsheets. Credentials in password managers without hardware binding. Third-party tools granted broad OAuth scopes that nobody ever reviews. No alerting on logins from new geographies. The moment a session token is stolen, there is no mechanism to detect it, because the session looks legitimate — it is legitimate, in the platform's eyes. Government accounts are worse, not better, because they combine high value with bureaucratic procurement cycles that lag the threat landscape by years. A public institution cannot simply adopt a new security tool the way a startup can. Procurement takes months. Training takes longer. And the threat moves at the speed of a malware kit update. The asymmetry is brutal. The attacker doesn't need to be brilliant. They need to be patient and opportunistic. The defense needs to be excellent every single day. The offense needs to be lucky once. Here's the core insight, and it's the one I want you to sit with. Crypto's entire information layer is anchored to Web2 accounts. When you see an announcement from a protocol, a foundation, an exchange, or a government, you are trusting a centralized platform's identity verification. That verification was just stripped and forged. The attacker didn't break cryptography. They broke a checkmark. For an industry whose foundational premise is "don't trust, verify," this is an embarrassment. We verify the chain, but we trust the tweet. We audit smart contracts line by line, but we take a screenshot as gospel. We build multi-signature wallets to protect our treasury, then announce the address from an account protected by a password and an SMS code. The verification surface is the weakest link in the entire stack, and it's entirely outside our control. The floor is just a ceiling for those who blink — and the floor here is the assumption that an official account is an official source. That floor just fell through for 900,000 people. Most of them will never know it happened. If you're a trader or a security researcher, the actionable intelligence from this event is on-chain. The phishing flow, if it captured victims, will produce observable patterns. Watch for newly deployed wallet drainer contracts. These typically match known signatures: approval exploits that call setApprovalForAll to an unknown operator, permit2 abuses, or "sign to claim" functions that transfer token ownership. The contracts are often deployed hours before the campaign and funded from the same source as previous drainers. Watch for fund aggregation. Scam proceeds are typically consolidated into a small number of wallets before being moved. A cluster of small inbound transfers from many distinct addresses, followed by a large outbound transfer, is the signature of a cash-out operation. Watch for cross-chain hops. Funds often bridge to another chain, or move through a mixer, before hitting an exchange deposit address. The bridge or mixer is a deliberate obfuscation step. Watch for exchange deposit clustering. The final hop is usually a centralized exchange. If you can identify the deposit address, you can flag it to the exchange, which may freeze the funds if they haven't already moved. For the average holder, the practical takeaway is simpler and more urgent: if you signed anything in response to that post, revoke your approvals immediately. Use a tool like Revoke.cash or the approval management interface in your wallet. A signed approval doesn't drain you instantly — it grants the attacker a standing right to move your tokens at their convenience. Revoke it and you cut the line before they pull. This is the part of the response that people skip, because it requires action and most people assume they weren't affected. Assume you were. Check. Revoke. It costs you gas and five minutes. The alternative costs you your wallet. Now let me argue against the consensus framing, because the standard take on this story is wrong in a way that matters. The consensus take: "Another crypto scam. Be careful. The police got hacked. Don't click links. Enable 2FA." That take is not wrong, but it's shallow. It treats the event as a discrete failure with a discrete fix — better authentication, more vigilance, a stern warning. It misses the structural point entirely. Here's the contrarian read. The problem is not that the Irish police accounts got hacked. The problem is that we built an industry where a hacked account can be mistaken for a legitimate source at all. And more specifically: the problem is that we keep building trust on top of infrastructure we don't control and can't audit. Think about what would have happened if the same content had been posted by an anonymous account with no followers. Nobody would have clicked. The phishing worked — or was designed to work — because of the institutional badge. The attacker didn't exploit a security hole in the traditional sense. They exploited the trust that the badge confers. The hack was the delivery mechanism. The trust was the vulnerability. This inverts the usual security conversation. We talk about "securing accounts." But the real question is: why does a platform-issued badge carry so much weight in a system whose entire ethos is cryptographic verification? Why is the root of trust a company's product feature? The answer is uncomfortable. Because we never built the alternative. Decentralized identity, on-chain verification, cryptographic attestation of communications — these have been theoretical for years, discussed at conferences, prototyped by a handful of teams, and ignored by the market. In practice, when a protocol needs to reach its community, it posts on X. When a government needs to reach the public, it posts on X. The information layer of crypto is a Web2 layer, and it always has been. We didn't decentralize the thing that mattered most. So here's the real insight, and it's the one I'll plant as a flag for the next cycle: the next major security narrative in crypto won't be about smart contract exploits or bridge hacks. It will be about the identity and verification layer. Because as more capital, more institutions, and more public trust flow into this space, the attack surface shifts from the code to the communication. And the communication layer is the least secure part of the entire stack. I've watched this pattern before. In 2017, the vulnerability was tokenomics — people bought narratives they couldn't verify. In 2020, the vulnerability was execution — people missed the arbitrage because they couldn't write the script. In 2022, the vulnerability was governance — people trusted centralized narratives over on-chain data. Each cycle, the attack surface migrates. This cycle, it's identity. The person who understands where the next vulnerability lives has an edge before the market prices it in. Arbitrage isn't just a price difference between two venues — it's faster empathy. The trader who feels the market's blind spot before it becomes consensus captures the spread. Right now, the market is pricing in smart contract risk and bridge risk. It is not pricing in verification-layer risk. That's the gap. That's where the asymmetric bet lives. There's a second contrarian point, and it's about the platform. X has an incentive structure that is fundamentally misaligned with institutional security. Verification is a product feature, not a security guarantee. The platform monetizes verification. It has reduced moderation capacity. It has, under current ownership, deprioritized trust and safety relative to engagement. The institutional badge is now more accessible and less meaningful than it was during the 2020 era. Meanwhile, the account takeover surface has not shrunk — if anything, it has grown as session token theft techniques have industrialized and as the value locked behind a successful phishing campaign has increased. So the practical implication is stark: treat every official account as compromised by default. Not because it is, but because the cost of being wrong is asymmetric. If you treat it as legitimate and it's compromised, you lose your assets. If you treat it as compromised and it's legitimate, you lose some convenience. The expected value math is obvious. The posture is exhausting, but it's the rational response to a verification layer that cannot be trusted. We didn't get to this point by accident. We got here by building a decentralized financial system on top of a centralized communication system and pretending the seam didn't exist. The seam just ripped open in front of 900,000 people. Let me give you the actionable version, because analysis without execution is entertainment. First, if you interacted with the Garda accounts or any similar "allocation" post in the last week, revoke your wallet approvals now. Every approval you granted to an unknown contract is a standing permission. Revoke them. Don't wait for a drain. Don't assume you're safe. Check. Second, assume every "official account" announcement is hostile until verified through a second, independent channel. For a protocol, that means checking the on-chain contract address directly — not the website, not the tweet, the actual deployed contract. For a government, that means a separate official website or a verified secondary channel. A single source is no source. This is the operational discipline that separates survivors from statistics. Third, if you run an institutional account — or any account with real reach — move to hardware security keys, eliminate SMS two-factor, audit every third-party OAuth integration, and monitor for anomalous session activity. The cookie theft vector means your password and your 2FA are not enough. Session hygiene is the new perimeter. Fourth, and this is the long game: watch the identity and verification layer. The projects that solve cryptographic attestation of communications — decentralized identity, verifiable credentials, on-chain identity primitives — are solving the problem this hack exposed. The market hasn't priced this yet. It will. When the next institutional account falls — and it will — the narrative will shift, and the projects positioned for that shift will re-rate. That's not a trade for today. It's a thesis for the cycle. The Irish police accounts will be restored within days. The investigation will produce a statement. The scam will be forgotten by next week. And the same thing will happen again, to a different institution, in a different country, because the underlying vulnerability — a trust layer we don't control — remains untouched. The question is not whether the next hack happens. It's whether you'll still be treating a blue check as a signature when it does.