Roaring Kitty X Account Hacked to Launch $RKC Token

High attention and emotional sentiment detected.

The token launched at approximately 21:07 UTC on May 11. Minutes later, the Roaring Kitty account posted the token’s contract address alongside cat and Pepe imagery. The account had been silent for 16 months before the suspicious post appeared.

Within 30 minutes, $RKC’s market cap surged to roughly $12.24 million. It then collapsed to around $2 million as coordinated sellers dumped their holdings. According to on-chain investigator @StarPlatinum_, more than 80 wallets extracted a combined $2,864,364 from the token. The attackers reportedly netted around $500,000 in profit.

How the Roaring Kitty Hack Unfolded

The $RKC token appeared on Pump.fun at 21:07:33 UTC. Its on-chain metadata included a direct link to @TheRoaringKitty’s X profile. On Pump.fun, anyone can embed social links in token metadata without verification from the referenced account.

At roughly 21:13 UTC, the Roaring Kitty account posted the token’s contract address with the caption “red bandit crew 4 life.” The post triggered a wave of FOMO buying from retail traders who believed Gill had returned to crypto.

The creator address listed on Pump.fun was the incinerator wallet (1nc1nerator11111111111111111111111111111111). This is a standard Pump.fun address used for creator-fee routing. It does not reveal the actual deployer’s identity.

On-Chain Evidence Points to Coordinated Extraction

On-chain data tells a clear story. According to @StarPlatinum_, over 80 wallets executed coordinated early buys through the bonding curve immediately after the post went live.

The largest holder at the token’s peak controlled roughly 3.69% of supply. That position was worth approximately $451,000 at the all-time high. These wallets used sniper bots and MEV searchers, tools that monitor new Pump.fun launches in real time and bundle buys for speed.

Total sell volume exceeded $10.56 million on PumpSwap. Overall trading volume in the first hour surpassed an estimated $20 million. The token now trades at a fraction of its peak with minimal liquidity.

Src: Lookonchain (X)

Who Is Keith Gill?

Keith Gill, known online as Roaring Kitty and DeepFuckingValue, became a household name during the 2021 GameStop short-squeeze saga. His detailed YouTube and Reddit analysis helped fuel a retail trading movement that inflicted billions in losses on short-sellers.

Gill briefly resurfaced in mid-2024 with cryptic posts that again moved GameStop’s stock price. Before Sunday’s incident, his X account had been inactive for roughly 16 months. He has no known history of promoting crypto tokens.

As of May 12, 2026, Gill has issued no public statement confirming or denying the hack. The promotional posts were deleted, and the account appears to have been recovered.

A Familiar Playbook on Pump.fun

This incident follows a well-documented pattern. Attackers compromise a high-profile social media account, then use it to promote a freshly launched Pump.fun token. Sniper bots buy early, retail traders pile in on FOMO, and the coordinated wallets dump at the top.

In 2025, Pump.fun’s own official X account was hacked in a similar fashion. Attackers launched a fake governance token that briefly surged before collapsing. Multiple other celebrity and influencer accounts have been compromised for the same purpose.

Pump.fun uses Solana’s Metaplex Token Metadata standard. Creators can embed arbitrary social links during token creation. The platform does not require authorization from the referenced accounts, so any hacker controlling a target’s X profile can create a false endorsement.

Community Reaction and Competing Theories

Sentiment across X, Reddit, and crypto Telegram groups was overwhelmingly negative. Users on r/Superstonk and r/wallstreetbets expressed alarm and urged others to report the account. Retail victims voiced frustration, while some on-chain traders admitted profiting from the snipe.

A small minority pushed back against the hack narrative. User @0xCalavera posted “No hack It was him,” and others speculated that Gill or someone close to him may have authorized the launch. No evidence supports this theory. The 16-month silence and immediate post deletion strongly favor the compromise explanation.

GameStop shares saw brief intraday volatility tied to the news, according to reports from Yahoo Finance and BeInCrypto.

What Remains Unknown

Several key details are still missing. The exact method of compromise, whether SIM swap, phishing, session hijack, or credential theft, has not been disclosed. No law enforcement agency has issued a statement. There is no information about whether Gill plans to address the incident publicly.

The identity of the operators behind the sniper wallets also remains unknown. Transaction histories are publicly verifiable on Solscan, but wallet ownership is not.

What This Means for Account Security in Crypto

The Roaring Kitty hack reinforces a growing problem. High-profile X accounts remain attractive targets for token promoters because a single post from a trusted name can drive millions in volume within minutes.

Until platforms like Pump.fun implement metadata verification, and until X enforces stronger security defaults for high-profile accounts, this playbook will likely continue. Users should treat any sudden, out-of-character token promotion with extreme skepticism, regardless of the source.

This is not financial advice. Always verify token launches through multiple independent sources before interacting with any smart contract.