X Platform Accounts of Irish Police Compromised for Crypto Wallet Theft

Two official social media accounts belonging to the Garda Síochána were compromised, allowing attackers to post fraudulent cryptocurrency promotions. This incident exposes the risk of account takeover on high-visibility platforms, where trust in the brand can be leveraged to trick followers into handing over sensitive financial credentials.

What happened

The @GardaInfo and @GardaTraffic Twitter accounts were accessed by an unauthorized third party on a Wednesday evening, according to Graham Cluley. The attacker posted messages claiming that followers were eligible to receive free cryptocurrency through an airdrop. These posts potentially reached hundreds of thousands of users who follow the official police channels for public safety and traffic updates.

The @GardaTraffic account serves over 600,000 followers, while @GardaInfo has nearly 300,000 followers. The malicious posts included links that, if clicked, could trick victims into surrendering the keys to their cryptocurrency wallets. This action would allow the attacker to drain the victims' savings, using the police brand to lend credibility to the scam.

Why it matters

Beyond the immediate financial risk to users, the breach raises concerns about the confidentiality of direct messages. If an unauthorized person could publish posts, they may have also been able to access private communications containing sensitive personal information from members of the public. The Gardaí stated they are conducting an internal investigation into the incident.

A police spokesperson told the Belfast Telegraph that they are working with the X platform to understand how the unauthorized access occurred. Scammers often target established accounts with large followings because they are trusted and provide a rapid route to reach many potential victims. The Gardaí attempted to dampen fears regarding the compromise of sensitive information.

What to watch

• Monitor official social media channels for unexpected changes in posting frequency or content tone.
• Verify the authenticity of urgent requests for financial information via out-of-band communication methods.
• Check for unauthorized applications connected to high-privilege social media accounts in administrative dashboards.
• Review direct message logs for any unusual patterns or requests that deviate from standard operational procedures.

Signals worth monitoring

Security operations teams usually review authentication logs for successful logins from new or geographic locations inconsistent with normal administrative activity. Check whether application permissions granted to third-party tools have been expanded beyond their original scope, as this is a common pivot point for account takeover.

Monitor for sudden spikes in outbound link clicks from official channels, which often indicate a compromised posting mechanism. Look for direct message requests that ask for credentials or wallet keys, a behavior inconsistent with standard community management practices. Verify that multi-factor authentication remains enforced on all privileged accounts used for public communication.

What to do and how to stay safe: Twitter

• Revoke access for all third-party applications connected to social media accounts that do not have a verified business purpose.
• Enforce multi-factor authentication on all administrative accounts used for publishing content to public platforms.
• Monitor for unauthorized changes to account recovery options, such as email addresses or phone numbers, which attackers often alter to maintain access.
• Educate followers on verifying official communications through independent channels before clicking links or providing financial information.

Step-by-step guide: Social Engineering: How Manipulation Bypasses Technical Defenses

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific accounts were compromised in this incident?

The official @GardaInfo and @GardaTraffic Twitter accounts of the Garda Síochána were accessed by an unauthorized third party.

What did the fraudulent posts ask users to do?

The messages claimed followers were eligible to claim free cryptocurrency through an airdrop, directing them to links that could drain wallet keys.

Is there a confirmed fix for this vulnerability?

No fix has been confirmed yet; the Gardaí are investigating with the X platform to understand how the unauthorized access occurred.