Original author: Umbrella & David, TechFlow

On September 1, when the market’s attention and liquidity were focused on Trump’s $WLFI, the well-known on-chain detective @ZachXBT began to expose information again.

He exposed a spreadsheet of paid promotions by overseas KOLs, which recorded the paid promotions of crypto projects by multiple English-speaking KOLs on the X platform. Many accounts were involved, and the total payment amount exceeded one million US dollars; the quotation for a single tweet ranged from US$1,500 to US$60,000, depending on the status of the KOL.

ZachXBT pointed out that among the KOLs on this list, less than 5 accounts marked the word "advertisement" when posting promotional posts. This means that when most KOLs publicly post on social media, you don't know whether it is a post to make money or purely spontaneous sharing.

Later, another little detective @dethective further analyzed and sorted out this original table and found that these overseas KOLs have more fancy ways to play with paid promotion.

One person has multiple accounts and earns two shares of the project side's money

In @dethective’s analysis, one of the first issues that jumped out was that some wallet addresses appeared repeatedly in the list.

This means that the same wallet may correspond to multiple KOL accounts, but receive promotion fees twice or even multiple times for the same project.

Take the accounts @Regrets 10 x and @lynk 0 x as examples. The list shows that the former received $8,000 for four posts, while the latter received $12,000 for the same four posts. This may be due to the different follower sizes of the two accounts.

But their wallet addresses are exactly the same:

EKvYizd 7 LqTmMj 4 QqmKsHm 8 wdg 7 TXzFoHHg 664 FdnhCRh

After cross-comparison, blogger @dethective found that there were more than just these two accounts, and there were about 10 similar duplicate wallets in the entire list.

One possible reason is that some overseas KOLs, in order to expand their influence, used secondary or associated accounts to promote their products without changing their wallet addresses, which exposed their tracks.

But if you think about it more deeply, whether it is due to laziness or negligence, not changing the wallet address actually reflects the situation of cluster hype, that is, multiple accounts posting the same project at the same time are more likely to occupy the timeline and attention of social media, thereby triggering fans' FOMO emotions.

Of course, the parties involved in the two KOL accounts that were exposed were not idle either.

@lynk 0 x denied receiving any money in the comments section, saying @Regrets 10 x was just a friend and that the wallet sharing was purely coincidental. But @dethective quickly provided evidence:

The wallet mentioned above received $60,000 from an airdrop from a project called "Boop." To claim the airdrop, it had to be linked to account X. This indirectly proves the control relationship between the account and the wallet, making denial somewhat untenable.

@Regrets 10 x's response was more casual. He didn't directly address the accusation, but said that paid promotion is fine as long as it is disclosed at the time of posting.

There is nothing wrong with accepting advertisements while eating. Appropriate disclosure will also help others understand the motivations and interests of the post. Some more professional KOLs will often add a sentence "interested" or "no interest" after a post.

But the problem is that if two accounts belong to the same person, and the same promotional content is displayed, one account publicly reminds the user that it is an advertisement, while the other account remains silent. This is more like a personality creation strategy of an account matrix.

What's worse, the practice of opening and promoting accounts in batches has become an industrial chain.

Previously, the research organization DFRLab published a study titled "Analysis of Crypto Scams on Twitter" , which mentioned that some gray industries can control dozens of accounts and publish nearly 300 tweets every day, creating false public recognition through batch account maintenance, automated forwarding and replies, and cross-endorsement.

The operators usually acquire old accounts or register new accounts in batches. After changing the nickname and avatar, they become a brand new KOL and then use scripts to copy the same recommendation words into the comment section of high-traffic tweets to "attract fans."

"To The Moon"

After the list was exposed, another point that attracted people's attention was that the sources of profits in the wallets of these overseas KOLs often highly overlap with the tokens they promoted.

In other words, they did not just post to share their “experiences” casually, but received the task first, and then followed the transaction after pushing the post.

For example, the account @0xSweep, according to @dethective’s wallet analysis , his biggest source of profit is several tokens on the BullX trading platform: $AETHER, $BOB, $BARSIK, etc.

But the whole story is that these tokens all have a record of paid promotion on the list leaked by ZachXBT; and @0 xSweep's X post also mentioned them repeatedly, believing that the tokens have great potential and have the potential to reach the moon.

However, his wallet records show that these profitable transactions occurred just before and after the promotion. It is very likely that the project party paid him to post, and after he posted, the token became popular, so he operated it himself to show that it was trading.

This also means that if an account is still repeatedly telling you its experience in trading tokens, its income may not come from trading and market judgment.

A similar situation is @ShmooNFT. His Telegram channel promotes around 10 tokens every day, which at first glance seems like a warm sharing.

However, wallet tracking shows that his only few profitable transactions, such as $DEGE, $BON, and $BOTIFY, were all promoted on X and were also on the list of whistleblowers mentioned by ZachXBT.

The core problem of this model is that the KOL’s “suggestions” carry personal opinions: the promotional posts are not marked as advertisements, so fans think they are genuine recommendations, but in fact they are paid collaborations.

If the token does have potential, everyone will be happy, but if the number of KOLs continues to drop to zero, the KOL's own credibility and influence will also decline.

The clever thing about this routine is that these overseas KOLs may earn three profits from it.

First, they get free tokens through airdrops, then charge promotion fees to the project party, and finally sell the airdropped tokens after raising the price by shouting orders.

And the common advanced gameplay: after shaping the image of oneself as the "God of Trading" by showing off orders and profits, one can then set up a paid group and charge an "entry fee".

Where there is demand, there is a market

At the end of the analysis post, dethective also asked a question worth pondering:

Why do some project owners still choose these accounts even though they know the habits and tactics of some overseas KOLs?

The answer is that where there is demand there is a market.

Some projects prefer this kind of audience who "want to get rich quickly", and some of the accounts mentioned in the previous article, whose channels and groups perfectly attract this audience: they do not have independent research capabilities, believe in shouting orders and taking chances, and try to find an undervalued golden dog.

Often, such KOL accounts will be defined as "more commercially valuable" in a marketing market where bad money drives out good money.

Leaking information itself involves conflicts of interest and can easily lead to trouble; however, as long as one or two token recommendations are successful, it can easily be sliced and spread to create the image of a trading guru.

In a market where noise and truth are hard to distinguish, crypto investing is not as simple as following the market’s calls. There will always be bloggers who make money forever, but the lost funds will never come back.