Prominent on-chain sleuth ZachXBT has recently uncovered compelling evidence linking convicted UK hacker Gurv – whose real name is Gurvinder Bhangu – to the recent compromises of American actress Sydney Sweeney’s and ‘Breaking Bad’ actor Bob Odenkirk’s X accounts.
This resulted in over $530,000 stolen through Solana meme coin scams.
SWEENEY Pump and Dump
On July 2nd, Sweeney fell victim to a SIM swap attack, and a link to a fraudulent meme coin based on Solana called SWEENEY, was posted from her account, causing the coin’s price to spike and then plummet.
According to ZachXBT’s latest findings, team wallets from the SWEENEY scam sold off more than $515,000 worth of the coin before cashing out. Following the incident, the hacker appeared to have brazenly trolled social media and attempted to take credit for other high-profile incidents. This included those involving retired professional wrestler Hulk Hogan and rapper 50 Cent, though evidence for these claims is limited, as per the on-chain detective.
Using timing analysis, ZachXBT further traced the proceeds from the SWEENEY scam to an exchange on Solana, where they were converted to Bitcoin and Ethereum. Additionally, screenshots surfaced online showing Gurv receiving codes to log into Sweeney’s account from the SIM swap on Telegram, along with a receipt from Verizon for the SIM swap.
Gurv, who previously served time in the UK for hacking Instagram accounts and blackmailing users, was identified as the person in these screenshots based on his unique Telegram user ID and his conversations about his prison time.
Bob Odenkirk’s X Account Shared Similar Fate
Further investigation revealed that on July 9th, 1.5 ETH was transferred to an exchange and then received on Solana, connected to the Sydney Sweeney SIM swap. That same day, Bob Odenkirk’s X account was similarly hacked, with links to meme coins KIRK and SAUL posted.
Despite the attempt, the hackers only profited a small amount due to the scam’s mishandling. Interestingly, proceeds were traced back to the same Ethereum address used in the Sweeney hack.
Evidence further suggests that funds were transferred to crypto casinos and gift card purchases. Meanwhile, the wallets connected to the hacks currently hold $488,000.
“Hopefully UK law enforcement will be quick to go after Gurv again using the large amount of evidence available.”