A Twitter account linked to Donald Trump promoted a token called $GOLD before wallets associated with the project appeared to sell their holdings. This added concern about how Trump-linked accounts can be used to lend credibility to speculative crypto tokens.
The Twitter account realtrumpcoins1 is followed by @realDonaldTrump and describes itself as an “Official Partner of The Trump Organization.” The Trump Organization’s account on X has retweeted its merchandise advertisements as well.
Coin Bureau flagged the $GOLD posts as an apparent hack, but neither the account holder nor the Trump Organization has separately confirmed that the account was compromised.
⚠️ ALERT: Trump-linked account appears to have been HACKED to promote a “Trump Digital Gold” rug pull.
A post promoting $GOLD appeared on ‘realtrumpcoins1,’ an account followed by the official Trump account and linked as a merchandise partner to the Trump Organization.$Gold… pic.twitter.com/pt8XhkdgJz
— Coin Bureau (@coinbureau) August 29, 2026
The account already has a link with Trump, which helped it quickly gain a level of legitimacy necessary for impersonation fraud to succeed.
Why a single meme coin scam travels far beyond one token
The use of celebrity and politician tokens continues to be a common source of retail risk, often causing complications beyond just one token.
Chainalysis found that scam addresses received at least $14 billion on-chain in 2025 and said the total could exceed $17 billion as more illicit addresses are identified. Impersonation scams surged more than 1,400% year over year.
The $GOLD incident followed a familiar pattern: the presence of a seemingly legitimate account, new coins being created, and people rushing to buy them before the verification process happened. Every time such incidents occur, the genuine crypto projects are forced to work even harder to gain this needed trust.
How the rug played out on-chain
Lookonchain raised the alarm on the concentration of the token’s supply quickly, pointing out that the developer held 600 million of the tokens and 15 new wallets paid $18,657 to get 224.5 million tokens. The combination allowed them to control 82.45% of the supply.
Afterwards, the wallets sold their holdings, amounting to 224.5 million coins, and made 3,178 SOL, which had a value of around $330,000. Lookonchain estimated that their total gross of about $ 312,000 was subject to a margin multiple of 17.
That concentration made it possible for a small number of people to make decisive moves in the market, which made ordinary traders vulnerable.
The hacker’s $8.2 million claim is not backed by tracked wallets
Another post from that account showed a bigger picture. According to ChainCatcher, the account claimed to have made more than $8.2 million in profits and mocked those who bought the token.
“low IQ Trump supporters”— @realtrumpcoins1, as reported by ChainCatcher on August 29, 2026
The account also stated that the profits were meant to fund a $10 million bounty on Barron Trump and included further claims of $165 million in Solana allegedly stolen from him. ChainCatcher characterized these declarations as biased and unproven.
The wallets being monitored have not confirmed the figure of $8.2 million. Lookonchain recorded some $330,000 in proceeds and $312,000 in profit from the collection of 15 tracked wallets. However, this information by itself cannot confirm the total earnings of the attacker from all other wallets.
Iranian cyber angle is raising the stakes
Some reports attributed the apparent compromise to Iranian hackers, but that claim has not been independently confirmed.
The timing is notable. NPR reported on August 26 that the Secret Service was aware of an Iranian state-media video appearing to threaten Barron Trump. The video referred to “our $10 million prize,” apparently suggesting a bounty—the same figure later invoked by @realtrumpcoins1. The U.S.-Israeli conflict with Iran began on February 28, 2026.
Iranian cyber activity has also increased during the conflict. The Center for Strategic and International Studies reported on August 6 that operations had risen since March across espionage, disruptive attacks, information operations and conflict-themed cybercrime.
The overlap makes the attribution worth examining, but it is not proof that Iranian actors controlled the account or orchestrated $GOLD.
This has happened to the Trump orbit before
The playbook is familiar. In February 2025, the X account of World Liberty Financial co-founder Zach Witkoff was compromised and used to promote a fake Barron Trump memecoin. The attacker claimed, “Trump should confirm the news soon.”
World Liberty Financial warned users:
“@zachwitkoff’s account was compromised, and a fake Barron meme was posted. Please do not engage. We are resolving the issue ASAP.” — World Liberty Financial, February 12, 2025
Ivanka Trump had also warned weeks earlier about an unauthorized memecoin using her likeness.
For a market that continues to reward Trump-branded assets, the pattern matters. Cryptopolitan reported on August 22 that Official Trump (TRUMP) had rallied more than 80% amid renewed speculation around Trump-family crypto activity.
The $GOLD episode exposes the weakness clearly: when a familiar account can move money before anyone verifies who’s behind the keyboard, reputation itself becomes an attack surface.
The smartest crypto minds already read our newsletter. Want in? Join them.
