Loading article…
Crypto scammers stole adult creator Patrick Bewley’s 132K‑follower X account, demanded $2‑3K in crypto and flooded it with MAGA posts.
Patrick Bewley, a 60‑year‑old gay OnlyFans performer with 132,000 X followers, had his verified account hijacked in early April and was forced to confront a $2,000‑$3,000 crypto ransom demand; when he refused, the attackers turned the feed into a daily stream of pro‑Trump propaganda [1][2].
| At a glance | |
|---|---|
| Followers lost | 132,000 |
| Ransom demand | $2,000 in GAT crypto (later $3,000) |
| Hijack date | April 9 2024 |
| Propaganda volume | 20–30 MAGA posts per day |
The intrusion began when Bewley clicked a phishing link sent by a colleague whose own X account had already been compromised. The fake login page let the attackers change the account’s name, phone number and email, and they swapped the handle twice—first to @DADDYPATRIOzvu and then to @Fatherokdwcjo63 [1][2]. Within days the profile banner was replaced with a black‑and‑white image of Steve Bannon promoting his WarRoom.org platform, and an avatar link‑tree to Bannon’s media outlets. By April 16 the hijacker was posting a Trump image with the caption “GOOD MORNING, I’M STILL YOUR PRESIDENT,” and then demanded a $2,000 GAT token ransom to restore the account [1][2]. Bewley’s partner appealed for help, but the extortionist escalated the demand to $3,000 after contacting Bewley’s employer, Ducati Studios Network [1][2].
When Bewley refused to pay, the attackers flooded the X feed with 20–30 pro‑MAGA reposts daily from accounts such as @MAGAVoice, effectively weaponising the creator’s brand against his own audience. Bewley says the loss of a high‑follower X presence “dictates who will want to work with you” in the adult‑industry ecosystem, where a verified follower count above 100,000 confers credibility and business opportunities [1]. Other gay OnlyFans creators—including Fabian Quezada (Buck Bronco) and Liam Angell—have reported similar hijack attempts, with some forced to change bank details or endure months of crypto‑spam to their followers [1][2]. The wave of attacks coincided with X’s April purge of fake and inactive accounts, which creators suspect provided cover for the phishing campaigns [1].
The episode underscores how crypto‑based extortion can be weaponised to damage personal brands, especially for creators whose livelihoods depend on social‑media reach, and raises questions about platform responsibility and the scalability of AI‑driven phishing campaigns.
Coverage is mostly measured — 81 of 83 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Jun 30, 2026 · How we report
He was sentenced to 15 months in federal prison.
They used phishing links to gain control of accounts, then demanded payments in crypto and posted political content when victims refused.
It monitors the clipboard and replaces a copied wallet address with one owned by the attacker, redirecting the funds.
The attacks coincided with X’s April purge of fake and inactive accounts, which may have provided cover for the hackers.
Yes, the malware also attempts to exfiltrate seed phrases and private keys.