Robinhood CEO Vlad Tenev’s X account was reportedly compromised on July 23 and used to promote a memecoin called Vladhood ($VLAD), according to on-chain observers cited in the report. The incident is notable given Robinhood’s position as one of the largest regulated retail trading platforms in the United States, serving millions of users — making impersonation of its CEO a potentially high-impact vector for scams. Several unusual signals around the token’s launch led investigators and market participants to treat the post as the result of an account hijack rather than an official Robinhood announcement.

Evidence cited in the alleged hijack

The post from Tenev’s X account announced the launch of Vladhood ($VLAD), describing it as the “official Robinhood chain mascot” and claiming that the token would also be featured on the Robinhood app. The token was quickly viewed as a scam after on-chain activity suggested that a small group of wallets had positioned themselves before the public post appeared.

According to the report, about two hours before the post from Tenev’s account, ten wallets were funded through Relay. Within minutes, those addresses purchased $VLAD, creating what investigators described as a 70% ownership cluster.

The timing of the wallet funding and purchases raised suspicions that a coordinated group may have known about the launch before the announcement. The wallets were reportedly set up earlier and accumulated the token before the public post from Tenev’s account.

After the announcement drew buying interest, those same wallets allegedly began selling their holdings within minutes. The pattern was described as consistent with a traditional pump-and-dump scheme — a manipulative tactic documented across numerous crypto token launches in which coordinated groups accumulate tokens before promoting them to retail buyers, then sell into the resulting demand.

Together, the pre-funded wallets, concentrated token distribution, and rapid sell-off led many observers to believe that Tenev’s X account had been hijacked to promote $VLAD. Based on MLM’s on-chain monitoring, the attacker generated approximately $1.2 million to $1.3 million from the VLAD token, worth about 650 ETH.

Tenev regains access to account

After recovering access to his X account, Tenev acknowledged the account hijack on X, according to the source report. The article did not provide the full text of his post. The quick recovery and acknowledgment follow a pattern seen in similar incidents, where affected parties move to disavow fraudulent tokens and limit further harm.

Robinhood Chain activity helped make the post appear credible

The incident occurred as Robinhood’s newly launched blockchain, Robinhood Chain, was attracting attention following its release earlier in July. According to Dune Analytics, the network had accumulated more than $750 million in on-chain assets since launch.

User activity on the network had also increased, with Robinhood Chain recording more than 300,000 Daily Active Addresses and processing about 10 million transactions in a single day. The source report said those figures helped make the sudden appearance of $VLAD seem credible to some market participants at first, as the platform’s rapid growth created plausible conditions for a new token launch.

The report’s final summary also referred to $700 million in on-chain assets and 300,000 daily active addresses as factors that made users believe the launch could be legitimate.

Similar account compromises

The reported compromise of Tenev’s account follows earlier cases in which high-profile X accounts were used to promote fraudulent memecoins. In 2024, the X accounts of several well-known individuals, including 50 Cent, Doja Cat, Sydney Sweeney, and others, were compromised in similar incidents. These attacks have become a recurring problem as the expansion of memecoin trading has created financial incentives for hijacking accounts with large followings.

In the $VLAD case, the 70% ownership cluster was one of the main indicators cited as evidence of the alleged exploit.