A growing number of gay OnlyFans creators have reportedly lost control of their X accounts in coordinated phishing attacks. The hackers then demanded cryptocurrency payments and filled the compromised profiles with political content and crypto spam.
Several victims said the attackers threatened to keep their accounts unless they paid thousands of dollars in digital assets.
OnlyFans Creator Loses X Account in Phishing Attack
One of the most notable victims was adult performer Patrick Bewley, also known as Daddy Patrick.
Bewley had attracted approximately 132,000 followers on X in less than two years. However, his account suddenly began publishing political posts that he had not created.
According to a WIRED report, the attack began on April 9. Bewley received a direct message from adult film director Jasun Mark, whose X account had already been compromised.
The message asked Bewley to support an award nomination. It also included a link to a fake X login page.
After Bewley entered his account details, the attacker changed the connected email address, telephone number and username. The profile handle was later changed twice.
Hackers Demand Cryptocurrency Ransom
The attacker reportedly redesigned Bewley’s profile with political imagery and links to Steve Bannon’s War Room platforms.
By April 16, the account had started publishing pro-Trump images and political posts. The hacker then demanded $2,000 worth of GAT tokens in exchange for returning the account.
Bewley refused to pay the cryptocurrency ransom.
The attacker later contacted his employer, Ducati Studios Network, and increased the demand to $3,000 in crypto. The compromised profile also began reposting between 20 and 30 political messages every day.
More OnlyFans Creators Report Similar Attacks
Bewley was not the only creator targeted during the account hijacking campaign.
Performer Fabian Quezada, who works under the name Buck Bronco, reportedly lost access to his X account on April 12. The attackers later contacted him through WhatsApp and attempted to pressure him into paying.
Quezada refused to negotiate because he feared the attackers could steal additional money. As a precaution, he replaced his bank and credit cards.
Creators Liam Angell and Jasun Mark eventually recovered their accounts. However, Mark remained locked out for approximately one month.
During that period, the attacker used Mark’s profile to promote cryptocurrency content to his 68,000 followers.
Chicago-based creator Gray Dickson also publicly requested assistance in May after facing repeated phishing attempts.
Paid Verification Failed to Prevent Account Loss
Bewley said his paid verification subscription did not help him recover the compromised X account.
According to his account of the incident, X support responded several weeks later and said it could not verify that he was the original owner of the profile.
Bewley subsequently reported the attack to the Palm Springs Police Department and the Federal Bureau of Investigation.
The case highlights the risks faced by creators who rely on social media profiles to communicate with audiences and promote their businesses.
Losing access to an established account can lead to reputational damage, lost income and the exposure of followers to scams.
Criminals May Be Using AI to Scale Attacks
Rachel Tobac, CEO of SocialProof Security, warned that similar attacks could increase ahead of the U.S. midterm elections.
She suggested that criminals may be using artificial intelligence to identify valuable accounts, personalize phishing messages and target more victims at the same time.
Compromised accounts with large audiences are particularly attractive to attackers. Hackers can use the existing trust between creators and their followers to spread crypto scams, false information and malicious links.
Political Accounts Have Also Faced Crypto Hacks
High-profile political figures have also been affected by similar account hijacking incidents.
Last year, the personal X account of Paraguay’s president was compromised. The hacked profile falsely claimed that the country had adopted Bitcoin as legal tender.
Paraguay’s official presidential account quickly denied the announcement and warned users that the message was fraudulent.
The latest attacks targeting OnlyFans creators demonstrate how phishing campaigns can combine cryptocurrency extortion, account theft and political misinformation.
Creators and other social media users should avoid entering login credentials through links received in direct messages. They should also use strong passwords, authentication applications and backup security methods to protect their accounts.
