NONE

DESCRIPTION OF EVENTS

"#McDonald's #Instagram was hacked to promote a #Solana #memecoin called #GRIMACE, which quickly rose to a $20 million market cap before crashing."

"The deception was amplified by the hacking of McDonald’s Senior Marketing Director Guillaume Huin. The hackers accessed his social media accounts to post false ads for the GRIMACE token. These posts falsely claimed McDonald’s would follow the Instagram accounts of GRIMACE holders, adding a layer of legitimacy to the scam."

"INDIA X KR3W ON YOUR FOREHEAD THANKS FOR THE $700,000 NIGGA"

"mcdonalds If you're a holder of $GRIMACE, comment below, we will follow you on the official @McDonalds account. We love and appreciate all the supports of Grimace!"

"The hackers changed the profile and posted content to promote the meme coin, then openly mocked the victims after executing the rug pull. They identified themselves as "India X Kr3w" in their posts."

"On-chain sleuth ZachXBT revealed that McDonald's Instagram account was allegedly hacked and used to promote the meme token GRIMACE."

"Hackers used the compromised McDonald's Instagram account to promote a fake cryptocurrency called $GRIMACE coin. This was a classic "rug pull" scheme where the scammers pumped the coin to attract investors and then dumped their holdings, causing the coin's value to plummet. This scam led to a loss of approximately $700,000 for those who invested."

"The incident has been widely discussed on X, with users highlighting the audacity of the scam, the vulnerability of social media accounts of large corporations to such attacks, and the broader risks associated with cryptocurrency investments, especially meme coins."

"PANews News on August 21, Detective ZachXBT on the chain disclosed that McDonald's Instagram account was suspected of being stolen and promoted Meme tokens GRIMACE. It is reported that the market value of the token has plummeted after rising to US$25 million in thirty minutes, and is currently about US$639,000."

"The GRIMACE token's value skyrocketed in just a few minutes, reaching $25 million. However, the surge didn’t last long. The hackers, calling themselves “India X Kr3w,” quickly cashed out their holdings, causing the token's value to plummet to almost nothing, leaving investors with worthless assets."

"I purchase this morning $150,000 of the official McDonald's meme token, Grimace. I'm not sure if you're familiar with it but I wanted to understand - what utility do I get for that here? Umm, I going to ask my boss, hold on. Hi. How are you doing today? I'm good and you? Uh, this morning, I'm not sure if you're familiar - the McDonald's Instagram published the official McDonald's meme token. I made a small $150,000 investment in it - in the Grimace token, and I was assuming that there was some utility that I would get here, and I wanted - the devs did promise utility, and I wanted to know, what do I get? Do I get like a free happy meal or something? No. That is through the app. We don't do nothing with Instagram like that. You don't? No. Oh, I viewed it as a marketing campaign. And now the devs rugged it, so I lost like $150,000. We don't do that here. Oh my gosh... Wow. Yeah, you have to load on the app. That is the - the only way that they do a specials or give you something free for that. Okay. We don't do nothing like that. Wow that's crazy. Man. Maybe I shouldn't have purchased that, you know. I'm not sure. $150,000 gone. I mean, it's not that big of a deal, but jeez - alright. Yeah, we don't..."

"Sorry mah nigga you have just been rug pulled by India_X_Kr3w thank you for the $700,000 in Solana."

"The posts have since been deleted."

"GRIMACE rugger who hacked @McDonalds hold approx. 3000 $SOL worth 450.000$ in these wallets.

As money splits in 2 wallets, probably they are team of 2

wallet 1 : 9yMwSPk9mrXSN7yDHUuZurAh1sjbJsfpUqjZ7SvVtdco

wallet 2 : 2vjnmxwTYNJvTmFhtqxZkPiuCHkaKZK5rcxTLuoC2dPB"

"While the immediate response from McDonald's regarding regaining control of their Instagram account was noted, there hasn't been detailed follow-up information on how they plan to address or prevent such incidents in the future, at least not directly from the X posts or related discussions."

"Everyone that got effected from the McDonald scam, we are getting together to make sure we get justice, JOIN THE #grimace movement"

"McDonald’s told the New York Post in a statement that it was aware of an “isolated incident” that had impacted its social media accounts on Aug. 21.

“We have resolved the issue on those accounts and apologize to our fans for any offensive language posted during that time,” McDonald’s said."

McDonald's official Instagram account started promoting a Grimace memecoin on August 21st. McDonald's later removed the posts and in a public statement, acknowledged that they were aware of a social media incident and apologized for any offensive language. It appears that the account was hacked, potentially through the compromise of the account of one of the marketing directors. The hackers appear to be a group referring to themselves as India_X_Kr3w and reportedly made a profit of $700k throught he promotion and subsequent rug pull of a Grimace meme coin. There are some community efforts to obtain justice for victims, and it is unclear how the situation will ultimately play out.

Example Domain (Sep 16)
SlowMist Hacked - SlowMist Zone (Sep 16)
麦当劳的Instagram账号疑似被盗并宣传某Meme币 - PANews (Sep 16)
Telegram: Contact @investigations (Sep 16)
@GrimaceOdysseus Twitter (Sep 16)
@braveadultclub Twitter (Sep 16)
@ZeroDayPwn Twitter (Sep 16)
@reinasdecrypto1 Twitter (Sep 16)
@agocripto Twitter (Sep 16)
@__Con_ Twitter (Sep 16)
@SolanaDegenLife Twitter (Sep 16)
@RektAlert Twitter (Sep 16)
@CryptoTsar0 Twitter (Sep 16)
@PORKBLUNT Twitter (Sep 16)
@alch3mist_x Twitter (Sep 16)
@InvestorJordann Twitter (Sep 16)
@inthemempool Twitter (Sep 16)
@_ronaldro_ Twitter (Sep 16)
@archivum_saves Twitter (Sep 16)
@subwayzarry1 Twitter (Sep 16)
@KittiesNice Twitter (Sep 16)
@ylvisthefox Twitter (Sep 16)
@KellyTrachtArt Twitter (Sep 16)
@CryptoXenith Twitter (Sep 16)
@GRIMACEMDS Twitter (Sep 16)
https://solscan.io/tx/2soH4siSEyZC9Mo1RRomYoXoqJLWgPxEXPaJKhPtwHjyRRp8sF1vpf71oMNPSKNkXEeF1JD7zpGtX9pdGqZysFw2 (Sep 16)
@CryptoNoted Twitter (Sep 16)
@Dannyd4crypto Twitter (Sep 16)
@lopezunwired Twitter (Sep 16)
@DamianProsa Twitter (Sep 16)
@Crypto_Q1 Twitter (Sep 16)
@GRIMACEMDS Twitter (Sep 16)
@tshirtsaleol Twitter (Sep 16)
@madcoinvip Twitter (Sep 16)
https://www.dextools.io/app/en/solana/pair-explorer/2PqCzv17ABV9VzSnexM9q7zcrMDccqFLiYuGr3avhGff (Sep 16)
https://solscan.io/tx/3ooaGHufRgDhguaoMEzGBPGCJHtun5QKUDdDD3Wj1QRhZJXLAz5dKVAjC5KPWwW8eysWRrFqHH2BXtnn9sJCz86j (Sep 16)
@15MinuteNewsBus Twitter (Sep 16)
@blckchaindaily Twitter (Sep 16)
@CryptoRugMunch Twitter (Sep 16)
https://dexscreener.com/solana/ebv3fvhxjeq73wnvqedddlm1ug5jc3azqufv7r9lwye (Sep 16)
@blackgokusei Twitter (Sep 16)
@brandonsalim Twitter (Sep 16)
@hatedbyfate_eth Twitter (Sep 16)
@thebryanjun Twitter (Sep 16)
@Hamburg_tuff Twitter (Sep 16)
@CryptoPress_ok Twitter (Sep 16)
@CryptosR_Us Twitter (Sep 16)
@TKBushleague Twitter (Sep 16)
@HearttOfUsa Twitter (Sep 16)
@Traders_pulse Twitter (Sep 16)
Telegram: Contact @grimacectowtf (Sep 16)
@Noparty1776 Twitter (Sep 16)
@pSquare_Daily Twitter (Sep 16)
@adamKDean Twitter (Sep 16)
@profkatn Twitter (Sep 16)
@1stepapp Twitter (Sep 16)
@DataPadi Twitter (Sep 16)
@coinpaprika Twitter (Sep 16)
Hackers Steal $700K in Fake McDonald's Meme Coin Scam (Sep 16)
@metaversico Twitter (Sep 16)
@Exworth_ Twitter (Sep 16)
@EasyEatsBodega Twitter (Sep 16)
@PorkPieETH Twitter (Sep 16)
@LordTrivia Twitter (Sep 16)
@BTCTN Twitter (Sep 16)
Hackers Exploit McDonald’s Instagram to Promote Fake Grimace Coin, Netting $700,000 in Solana – News Bytes Bitcoin News (Sep 16)
@nftAmmar Twitter (Sep 16)
@Altcoin_Alerts Twitter (Sep 16)
@SolTxgs Twitter (Sep 16)
@ChristiaanDefi Twitter (Sep 16)
@JackyNode Twitter (Sep 16)
@Degen999 Twitter (Sep 16)
@jase Twitter (Sep 16)
@DexterVro Twitter (Sep 16)
@bigsh0tnft Twitter (Sep 16)
@GeneralPudgy Twitter (Sep 16)
@PossessBrand Twitter (Sep 16)
@SadCreatorTalks Twitter (Sep 16)
@GRIMACEMDS Twitter (Sep 16)
@SlamXio Twitter (Sep 16)
@Onlineboss_ Twitter (Sep 16)
@brandonsalim Twitter (Sep 16)
@beincrypto_es Twitter (Sep 16)
@AlephSuper Twitter (Sep 16)

More case studies

Maker DAO Vault Ownership
Transfer Whale Phishing

HFLH Contract Relaunched
Claimed Vulnerability