A Twitter account linked to Donald Trump promoted a token called $GOLD before wallets associated with the project appeared to sell their holdings, intensifying concerns that Trump-linked accounts can be exploited to lend credibility to speculative crypto tokens.

The account, realtrumpcoins1, is followed by @realDonaldTrump and describes itself as an "Official Partner of The Trump Organization." The Trump Organization's account on X has also retweeted its merchandise advertisements.

Coin Bureau flagged the $GOLD posts as an apparent hack, but neither the account holder nor the Trump Organization has independently confirmed that the account was compromised.

⚠️ ALERT: Trump-linked account appears to have been HACKED to promote a "Trump Digital Gold" rug pull. A post promoting $GOLD appeared on 'realtrumpcoins1,' an account followed by the official Trump account and linked as a merchandise partner to the Trump Organization. $Gold … pic.twitter.com/pt8XhkdgJz

— Coin Bureau (@coinbureau) August 29, 2026

The account's pre-existing connection to Trump helped it quickly acquire the level of legitimacy necessary for impersonation fraud to succeed. That dynamic is especially potent on X, where verified checkmarks and follower counts can be inherited from an account's legitimate history, meaning a compromised account looks identical to an authentic one until the operator or platform intervenes.

Why a single meme coin scam travels far beyond one token

Celebrity- and politician-branded tokens remain a persistent source of retail risk, and the complications often extend well beyond a single token.

Chainalysis found that scam addresses received at least $14 billion on-chain in 2025, and said the total could exceed $17 billion as more illicit addresses are identified. Impersonation scams surged more than 1,400% year over year.

The $GOLD incident followed a familiar pattern: a seemingly legitimate account posts, new coins are created, and buyers rush in before any verification takes place. Each such incident forces genuine crypto projects to work even harder to earn user trust.

How the rug played out on-chain

Lookonchain quickly raised the alarm over the token's supply concentration, noting that the developer held 600 million of the tokens, while 15 new wallets paid $18,657 to acquire 224.5 million tokens. Together, they controlled 82.45% of the supply.

The wallets subsequently sold their holdings—224.5 million coins—collecting 3,178 SOL, worth around $330,000. Lookonchain estimated total gross proceeds of about $312,000, subject to a margin multiple of 17.

That concentration allowed a small number of actors to make decisive market moves, leaving ordinary traders exposed. Such concentration is a standard red flag that on-chain analysts check for when a new token appears: a small group of freshly funded wallets holding most of a supply can dump into any buying pressure almost instantly, which is what the tracked wallets did here.

The hacker's $8.2 million claim is not backed by tracked wallets

A subsequent post from the account painted a broader picture. According to ChainCatcher, the account claimed to have made more than $8.2 million in profits and mocked those who bought the token, referring to them as "low IQ Trump supporters."

The account also stated that the profits were meant to fund a $10 million bounty on Barron Trump, and made further claims of $165 million in Solana allegedly stolen from him. ChainCatcher characterized these declarations as biased and unproven.

The monitored wallets do not confirm the $8.2 million figure. Lookonchain recorded roughly $330,000 in proceeds and $312,000 in profit across the 15 tracked wallets—though that data alone cannot establish the attacker's total earnings from any other wallets.

Iranian cyber angle is raising the stakes

Some reports have attributed the apparent compromise to Iranian hackers, but that claim has not been independently confirmed.

The timing is notable. NPR reported on August 26 that the Secret Service was aware of an Iranian state-media video appearing to threaten Barron Trump. The video referred to "our $10 million prize," apparently suggesting a bounty—the same figure later invoked by @realtrumpcoins1. The U.S.-Israeli conflict with Iran began on February 28, 2026.

Iranian cyber activity has also increased during the conflict. The Center for Strategic and International Studies reported on August 6 that operations had risen since March across espionage, disruptive attacks, information operations, and conflict-themed cybercrime.

The overlap makes the attribution worth examining, but it is not proof that Iranian actors controlled the account or orchestrated $GOLD. Attribution in cases like this typically depends on platform logs, infrastructure forensics, and intelligence that outside observers do not have, which is why initial attributions frequently remain unconfirmed.

This has happened to the Trump orbit before

The playbook is familiar. In February 2025, the X account of World Liberty Financial co-founder Zach Witkoff was compromised and used to promote a fake Barron Trump memecoin. The attacker claimed, "Trump should confirm the news soon."

World Liberty Financial warned users at the time: "@zachwitkoff's account was compromised, and a fake Barron meme was posted. Please do not engage. We are resolving the issue ASAP." — February 12, 2025

Weeks earlier, Ivanka Trump had also warned about an unauthorized memecoin using her likeness.

For a market that continues to reward Trump-branded assets, the pattern matters. Cryptopolitan reported on August 22 that Official Trump (TRUMP) had rallied more than 80% amid renewed speculation around Trump-family crypto activity.

The $GOLD episode exposes the weakness plainly: when a familiar account can move money before anyone verifies who is behind the keyboard, reputation itself becomes an attack surface. What to watch next is whether the account holder or the Trump Organization confirms the compromise, whether X takes enforcement action against the account or the promoting posts, and whether any clearer attribution emerges from platform or security-researcher investigations.