At 4:11 pm Eastern time on 9 January 2024, the X account of the US Securities and Exchange Commission announced that spot bitcoin exchange-traded funds had been approved. They had not. Someone had hijacked the phone number linked to @SECGov, and with it the account. Anyone who knew how to check crypto news had the answer within minutes: no order, no press release, nothing new on sec.gov.
The SEC press office denied the post at 4:26 pm, writing from the account of the agency’s chair, Gary Gensler, according to the timeline in Gensler’s statement of 12 January 2024. After the false post, bitcoin rose by more than $1,000. Once the denial spread it fell by more than $2,000, according to Justice Department figures reported by The Record. The false post came from the regulator’s real account, so readers who trusted the name at the top got it wrong.
This lesson is about the habit that saved the others. It is less a list of sites to trust than a routine you run each time a headline makes you want to do something with your money. It closes our Getting started path. The previous lesson, on crypto myths and facts, sorted the claims people repeat about crypto; this one shows you how to test new claims yourself, in ten steps, with real cases and the free tools that regulators and fact-checkers publish. Facts are as of October 2026, and nothing here is investment advice.
How to check crypto news when a headline can move a price in minutes
Crypto markets never close. There is no closing bell that gives a newsroom, a company or a regulator the night to answer a rumour, so a false post at 4 pm on a Tuesday trades at once, worldwide. Many smaller tokens also have thin order books: a few buyers arriving together can lift them by double digits.
Add a simple motive. Whoever plants a false story can buy first, post, and sell into the rally the post creates. The lie does not need to survive the day. It only needs to last longer than the seller’s exit.
Speed trips up the people who report the news too. Several cases below spread through channels readers had every reason to trust, from a federal regulator’s own account to a wire service used by listed companies. Each time, the truth came from the same place: the party that should have made the announcement, and the document it did or did not publish.
Four fake crypto news stories that moved prices, and how each was exposed
| Date | What was claimed | Channel | How it was exposed |
|---|---|---|---|
| 13 September 2021 | Walmart would accept Litecoin | Press release on GlobeNewswire | Walmart denied any relationship with Litecoin; the wire withdrew the release |
| 16 October 2023 | The SEC had approved BlackRock’s spot bitcoin ETF | Cointelegraph post on X, based on a screenshot | Removed after about 40 minutes; BlackRock said the report was incorrect |
| 13 November 2023 | BlackRock had set up an “iShares XRP Trust” | Entry on Delaware’s corporate registry | BlackRock said the filing was fake |
| 9 January 2024 | The SEC had approved spot bitcoin ETFs | The SEC’s own X account, hijacked | Denial at 4:26 pm ET; post deleted at 4:42 pm ET |
The Walmart case is the oldest and still one of the clearest. On Monday 13 September 2021 a release distributed by GlobeNewswire said the retailer would let shoppers pay with Litecoin. The coin reached a high of $233.44 that day before falling back, Fox Business reported. Walmart’s statement needed six words for the key point: “Walmart has no relationship with Litecoin,” as The Block quoted it. GlobeNewswire blamed a fraudulent user account, withdrew the release and told readers to disregard it.
A wire service checks who holds the account that sends a release. It does not check that what the release says is true.
On 16 October 2023 it was a news site that slipped. The social media team of the crypto news site Cointelegraph posted on X that the SEC had approved BlackRock’s spot bitcoin fund. In its own clarification, the outlet said the lead was “an unconfirmed screenshot posted by an X user who claimed it was from the Bloomberg Terminal.” An employee posted it at 13:24 UTC without an editor’s approval; it was flagged as unconfirmed half an hour later and removed at 14:03 UTC. No article was published, and BlackRock confirmed the report was wrong.
Four weeks later, on 13 November 2023, an entity named “iShares XRP Trust” appeared on the website of Delaware’s Division of Corporations. iShares is BlackRock’s fund brand, so the entry looked like the first step toward an XRP fund. XRP rose about 12% in roughly 30 minutes, then gave the gain back. A BlackRock spokesperson told Decrypt that the filing was fake, and Decrypt, citing Bloomberg, reported that the Delaware Secretary of State’s office had informed the state Department of Justice. A name in a state company registry is not a filing with the SEC, which is where a real fund application appears.
The SEC hack itself took very little. On a page about the incident, the agency explained that multi-factor authentication on the account had been switched off by X’s support team in July 2023, at the request of SEC staff who were having trouble logging in, and stayed off until after the hack. The attacker took over the phone number through a SIM blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap done at the mobile carrier, not on SEC systems. The false post stayed up until staff deleted it at 4:42 pm, 31 minutes after it appeared.
In May 2025 an Alabama man, Eric Council Jr., was sentenced to 14 months in prison for his part. According to the Justice Department’s account reported by The Record, he used an ID made on a card printer to obtain a replacement SIM at an AT&T store in Huntsville, passed the codes he received to accomplices and was paid $50,000. He had pleaded guilty in February 2025 to conspiracy to commit aggravated identity theft and access device fraud.
One last detail makes this case worth remembering. The SEC did approve spot bitcoin ETFs, the next day, 10 January 2024. The false post was early, not imaginary, and that made it easy to believe. A story that will probably be true tomorrow is still false at the moment you act on it.
The ten-step check, in the order to run it
None of these steps needs paid software, and most take under a minute. Run them in order. The first three settle most stories; the later ones matter most when someone is asking you for money.
- Find the original document that the story is about, on the website of whoever should have published it.
- Work out what kind of text you are reading: reported news, opinion, a press release, paid content or a social post.
- Check the date, the time zone and what was happening before the story appeared.
- Ask who gains if you believe it, and look for any payment or holding that has not been disclosed.
- Make sure the account, the domain and every link are really what they claim to be.
- Treat videos of famous people and any giveaway as fake until you can prove otherwise.
- Compare the chart and the trading volume with the headline, minute by minute.
- Look up the firm or the person in an official register before you send them anything.
- Notice fear or urgency in yourself, and wait before you act.
- Keep a short list of primary sources and repeat the same routine every time.
Step 1: find the original document, not the post about it
Every claim has an author who would publish it first. An ETF approval appears as an order or a press release in the SEC newsroom. A fund application is a registration statement or an exchange rule filing, both searchable on SEC EDGAR, filed by the issuer. A listing, a partnership or a hack shows up on the company’s own blog or status page. A criminal case has a press release from the prosecutor and a court docket. If the story you are reading does not link to that document, go and look for it.
If you need a reminder of what a spot exchange-traded fund is and why its approval mattered so much to bitcoin, our glossary entry covers it. The point here is narrower. In all four hoaxes above, the document that should have existed did not, and a reader could find that out in two minutes.
On-chain claims are even easier to test. A post saying that a large holder moved 10,000 bitcoin, or that a project’s treasury was drained, refers to transactions anyone can open on a block explorer such as mempool.space for Bitcoin or Etherscan for Ethereum. Paste the transaction hash or the address and read the amount, the time and the destination yourself. Our lesson on what a crypto address is and how to read one explains the formats you will meet there.
A screenshot is never a document. It can be edited in seconds and carries no link back to its source. Cointelegraph’s false ETF post of October 2023 rested on exactly that: an image said to come from a Bloomberg Terminal. When the only evidence for a claim is a picture of a screen, treat the claim as a rumour, however serious the account that shares it.
Step 2: work out what kind of text you are reading
A crypto news site publishes several kinds of text under the same logo, and they deserve very different levels of trust. Reported news carries a byline, a date and named sources, and a serious outlet corrects it in public when it is wrong. Analysis and opinion give one person’s view, sometimes from someone who holds the coin being discussed. Research notes from exchanges and funds can be careful work, but their authors have products to sell.
Then there is text nobody at the publication wrote. A press release is written by the company and published as sent. Sponsored content is paid for. Look for the labels that mark it: “Press release”, “Sponsored”, “Commissioned”, “Partner content”, “Paid post” or “Advertorial”, usually near the title or at the foot of the page. Cointelegraph, for example, says on its advertising disclosure page that all paid content is clearly labelled, and its site has a separate Commissioned section for paid articles and press releases.
A missing label proves nothing, though. In October 2018 the crypto publication Breaker sent a fake PR agent to 28 blockchain media outlets; 12 of them said they would publish paid content about a token sale without marking it as sponsored, for fees between $500 and $4,500, The Next Web reported. The test is eight years old. Nobody has shown that the market for unlabelled paid posts has gone away.
Press releases themselves are a weak signal. Chainstory, a crypto PR firm, studied thousands of crypto releases issued between June and November 2025. According to Forklog’s account of the study, over 60% promoted platforms with classic warning signs (anonymous teams, inflated promises, template websites, aggressive marketing), and about 2% carried real news such as a funding round or a merger. The classification is the firm’s own and has not been independently audited. Semafor reported in February 2026 that two sites, Investing.com and CryptoPotato, had removed their articles about the study without explanation.
What “according to sources” and “reportedly” really mean
The wording of a story tells you how solid it is. “According to sources” or “people familiar with the matter” means the journalist knows who spoke and you do not. That can be good reporting, but it is not a confirmation you can check. “Reportedly”, “rumoured” and “unconfirmed” are warnings written into the sentence: the outlet is repeating something it has not verified.
“Confirmed” should always say by whom and how. “BlackRock confirmed to us” is a fact you can weigh; “it has been confirmed” is not. And when dozens of outlets publish the same story at the same minute, that is rarely a sign of dozens of separate checks. Often they are all working from one press release or one embargoed document, meaning a text handed out in advance for release at an agreed time.
Step 3: check the date, the time zone and what came before
Old news shared as new is one of the cheapest tricks there is. A real announcement from two years ago, a hack that was settled long since, an interview clip from a past conference: each can be put back into circulation with a fresh caption. Check three dates every time. The date the article was published, the date of the event it describes, and the date of any chart or figure it shows.
Video is reused the same way. On 13 November 2023, Ripple’s chief executive Brad Garlinghouse warned on X about a rise in deepfake scam videos that laid new words over old footage from Ripple’s own events, CryptoSlate reported. The stage and the face were real. The words were not.
Time zones cause their own confusion. US regulators and courts give times in Eastern time; most crypto data sites and many newsrooms use UTC. The fake SEC post at 4:11 pm ET on 9 January 2024 was 21:11 UTC. Before you compare a price chart with a news story, put both on the same clock.
Context is the last check of this step. Ask what else would have to be true if the story were true. If BlackRock had really filed for an XRP fund, the fund would appear on BlackRock’s own website and the application on EDGAR. If a major exchange had really been hacked, its status page would say something and the outflows would show on an explorer. When none of those traces exist, the story has nothing holding it up.
Step 4: follow the money behind the message
Someone benefits every time you believe a message about a coin. Often that is obvious, as with a project’s own announcement. It is hidden when a well-known person is paid to post about a token and keeps quiet about the fee.
The SEC’s best-known example is Kim Kardashian. On 3 October 2022 the regulator charged her for promoting EMAX tokens, sold by EthereumMax, on Instagram without disclosing that she had been paid $250,000 for the post. She agreed to pay $1.26 million in penalties, disgorgement and interest, and not to promote crypto asset securities for three years, without admitting or denying the findings. “Investors are entitled to know whether the publicity of a security is unbiased,” said Gurbir Grewal, then director of the SEC’s Division of Enforcement. The SEC had already warned in a 2017 statement on celebrity-backed token sales that promoters must disclose the nature, scope and amount of what they are paid.
Britain has its own regime. The Financial Conduct Authority’s rules on promoting crypto to UK consumers have applied since 8 October 2023. A promotion is lawful only in four cases: it comes from a firm the FCA has authorised, it is approved by such a firm, it comes from a crypto business registered with the FCA under the money laundering rules, or an exemption applies. Breaking that rule is, in the FCA’s words on its crypto marketing page, a criminal offence punishable by up to two years in prison, an unlimited fine, or both.
The FCA’s guidance on financial promotions on social media, finalised on 26 March 2024, spells out that influencers who promote a regulated product without an authorised firm’s approval may be committing a criminal offence. In October 2024 the regulator said it had interviewed 20 finfluencers under caution and issued 38 alerts against social media accounts. It also says 62% of 18 to 29-year-olds follow social media influencers, and that 74% of those followers trust their advice, according to its press release. In February 2026 seven influencers were sentenced at Southwark Crown Court for unauthorised promotions: fines ran from £600 to £3,750 and two received discharges. That case concerned a foreign-exchange trading scheme, not crypto.
In the European Union, the MiCA regulation has applied to all crypto-asset services since 30 December 2024, and it sets rules for marketing. Under Article 7, marketing for an offer of a crypto-asset other than a stablecoin-type token (those are covered by Articles 29 and 53) must be clearly identifiable as marketing, fair, clear and not misleading, and consistent with the white paper. It must also carry a statement that no authority in any EU country has reviewed or approved it. Article 91 bans market manipulation, including spreading rumours the author knew or ought to have known were false. It also lists this case: voicing an opinion on a crypto-asset in the media after taking a position in it, then profiting from the price effect without disclosing the conflict of interest. Those rules cover crypto-assets admitted to trading in the EU. Our guide to the MiCA regulation covers the rest of the text, and national regulators such as France’s AMF and Italy’s Consob enforce it.
European supervisors see the same pattern as the FCA. In a joint warning of 6 October 2025, the EBA, EIOPA and ESMA said that rising consumer interest in crypto was partly driven by aggressive promotion on social media by finfluencers, and urged consumers to check that a provider is authorised in the EU.
For you, the test fits in two questions. Who paid for this text, and does its author hold the coin? If the page gives you no way to answer, read it as an advert.
Step 5: check that the account and the link are what they claim
A hacked account is a real account, and that is what makes it dangerous. The SEC case was not a fake profile with a similar name. It was @SECGov itself. It keeps happening to people and projects with large followings.
In January 2025 the X account of the actor Dean Norris was hijacked and used to push a memecoin called DEAN with a doctored photo and video. The token reached a market value of about $8.43 million on 25 January, then fell below $60,000, a drop of more than 96%, according to DexScreener figures cited by Cointelegraph. On 5 February 2025 the main X account of Jupiter, a decentralised exchange aggregator on Solana, was compromised and promoted fake memecoins, first $MEOW and then $DCOIN; several users said they had lost Solana tokens, The Block reported.
The warning signs repeat. An official account suddenly promotes a token that appears nowhere on the project’s website, documentation or blog. The tone changes. Replies are switched off. The link points to a domain registered last week. Check the domain letter by letter: one swapped character, an extra hyphen or an unusual ending such as .xyz is enough to send you somewhere else.
Two rules cover most of the risk. Never connect a wallet, sign a transaction or type a recovery phrase because a post, a reply or a direct message asked you to. And when an account pushes something urgent, confirm it on a second official channel the project controls, such as its website or its documentation. Coindaro applies the same rule to its own reporting: a handle with one letter of difference, or a request to connect a wallet, is never treated as a source.
Step 6: treat celebrity videos and giveaways as fake until proven otherwise
Video used to feel like proof. In July 2024 the security firm Bitdefender described a campaign in which dozens of hijacked YouTube channels, one with 1.26 million subscribers, were renamed to look like Tesla and looped a deepfake of Elon Musk. A QR code on screen led to a fake crypto giveaway. Bitdefender’s advice was blunt: “Don’t scan QR codes in videos on YouTube that promise you too-good-to-be-true crypto giveaways.”
Ripple has fought the same scheme for years. The fake videos Garlinghouse warned about in November 2023 showed him endorsing a 100 million XRP giveaway that would double whatever viewers sent, with deposits of 1,000 to 500,000 XRP requested, according to CryptoSlate. You send first. Nothing comes back.
No legitimate company doubles the coins you send it, and no real giveaway starts with a deposit. Our guide on how to avoid crypto scams goes through the other common patterns, from fake support agents to fake airdrops.
For images and videos that are not obviously scams, a few checks help. A reverse image search with Google Lens or TinEye shows where a picture appeared first, and whether it has been edited. For a video, look at the channel rather than the clip: how old it is, whether it was recently renamed, whether comments are disabled. Deepfakes often give themselves away through lips out of sync with the voice or a short clip that loops. A QR code promising free coins is a giveaway of a different kind.
The most useful habit is what the US News Literacy Project calls lateral reading. Instead of studying the suspicious page itself, open new tabs and see what other sources say about it and about who is behind it. It sounds slower than it is: two or three searches usually tell you whether a site or a channel has a track record.
Step 7: compare the chart and the volume with the headline
A price chart shows the order of events better than any article. Compare the minute the price moved with the minute the story appeared. In the SEC case, bitcoin jumped after the false post and before any confirmation existed, then reversed once the denial came. A move that starts before the news may point to a leak or to manipulation, or it may be chance. A move that vanishes within the hour, like XRP’s 12% jump on the fake BlackRock filing, tells you about a hoax, not about the project.
Crypto wash trading: why volume can look bigger than it is
Headlines often cite trading volume as proof that something is happening. Volume can be faked. In a white paper dated 24 May 2019 and filed with the SEC, Bitwise, which was then seeking approval for a bitcoin ETF, estimated that roughly 95% of reported bitcoin trading volume was fake or non-economic. For April 2019 it put the fake or wash-traded share at $10.5 billion of the $11 billion reported each day; an earlier Bitwise study of 4 to 9 March 2019 found about $273 million of real average daily spot volume against $6 billion reported. Bitwise wanted to show regulators that a small, clean market sat underneath the noise, so read the figure as an interested party’s estimate.
Academic work points the same way. A study by Lin William Cong, Xi Li, Ke Tang and Yang Yang, published as an NBER working paper and then in Management Science in 2023, examined 29 exchanges. Regulated venues showed trading patterns similar to traditional markets. On unregulated ones, wash trading, where the same party trades with itself to inflate activity, averaged over 70% of reported volume.
The problem has moved on-chain too. Chainalysis estimated suspected wash trading on decentralised exchanges on Ethereum, BNB Smart Chain and Base at up to about $2.57 billion in 2024, and called that an upper bound because its two methods may overlap. Trending lists, “most active” rankings and even a token’s market capitalisation can look healthier than the real demand behind them. Check the same token on several venues, and for small tokens look at liquidity and the number of distinct wallets as well as volume.
Pump-and-dump groups pick their target in advance
Some price spikes are organised in the open. Jiahua Xu and Benjamin Livshits counted 412 pump-and-dump schemes coordinated through Telegram channels between 17 June 2018 and 26 February 2019, in a paper presented at USENIX Security 2019. An earlier study by researchers at the University of Tulsa, the University of New Mexico and Tel Aviv University logged 4,818 pump signals on Telegram and Discord between mid-January and early July 2018, and found that 10% of the Telegram pumps lifted prices by more than 18% within five minutes, Finance Magnates reported.
The pattern has not gone away. Chainalysis found that 74,037 tokens, or 3.59% of the 2,063,519 tokens launched in 2024, showed trading patterns that may be linked to pump-and-dump schemes, and that about 94% of the decentralised exchange pools involved were emptied by the address that created them. Chainalysis stresses that its method tracks behaviour, not intent, and “is not by itself sufficient to prove market manipulation.”
The people who gain from a pump are those who bought before the signal: the organisers. A reader who arrives because of a sudden headline or a trending list is usually the last buyer, not the first.
Step 8: look the firm up in an official register
Before you trust a platform, a fund or an adviser named in a story, check whether a regulator knows it. In the US, real filings by listed companies and fund issuers are on EDGAR, and the SEC publishes its enforcement actions and investor alerts on its own site. In the UK, the FCA keeps a register of authorised firms and a Warning List of firms and individuals running scams or operating without authorisation.
Across the EU, ESMA publishes an interim register under MiCA that lists authorised crypto-asset service providers, white papers for tokens and entities found to be operating without authorisation. The files are updated weekly and can be found on ESMA’s MiCA page, last updated on 16 October 2026 when we checked; the location may change as the register moves into ESMA’s main systems.
Read the name carefully. When the MiCA transitional period ended on 1 July 2026, Italy’s Consob and the Bank of Italy warned that the protections apply only to the authorised legal entity, not to other companies of the same group that use the same brand. A warning list works the other way round: being absent from it proves nothing, because regulators add names only after they spot them. Our guide on how to choose a crypto exchange shows how to run this check on a trading platform step by step.
Step 9: what FUD and FOMO mean in crypto, and why waiting beats both
Two acronyms describe the feelings that false news is built to trigger. FUD stands for fear, uncertainty and doubt: stories meant to make holders sell, or to make a coin look doomed. FOMO is the fear of missing out: the sense that everyone else is buying and the chance will be gone in an hour.
The four hoaxes in the table all ran on FOMO. Buy before the ETF is approved. Buy before Walmart customers start paying in Litecoin. Buy before BlackRock’s XRP fund opens. Each story offered a head start to whoever moved first.
FUD needs a more careful reading, because the word is also used to wave away real problems. Hacks happen and exchanges do fail. Calling a well-sourced warning “FUD” is a way of not answering it. Judge a frightening story by its sources, exactly as you would judge a cheerful one.
The practical answer to both feelings is time. The SEC corrected its false post in 15 minutes. Cointelegraph removed its own after about 40 minutes. XRP’s fake-filing jump faded within roughly half an hour. A personal rule of waiting an hour before acting on any headline, and using that hour for steps 1 to 8, would have kept a reader out of all three.
Step 10: build a short source list and a routine you repeat
A good routine is short enough to run on a phone. For each coin or company you follow, bookmark the place where its real news appears first: the project’s blog or documentation and a block explorer for its chain. Add the newsrooms of the regulators that matter to you, such as the SEC, the FCA or ESMA. When a story breaks, you go there before you go anywhere else.
Coindaro uses a ladder of sources that you can borrow. The primary document comes first: a regulator’s page, a filing, a court record, a project’s own post. Verifiable on-chain data comes next, then established media, then on-chain investigators whose addresses can be checked on an explorer. Analysts and influencers come last, as a reading of market mood rather than as evidence. Urgent or accusatory stories need two sources of different kinds. Our editorial policy describes how we apply this and how we correct mistakes.
Fact-checkers can save you time on claims that have already been tested. Google’s Fact Check Explorer searches articles published by fact-checking organisations. EU DisinfoLab, an independent non-profit, studies disinformation campaigns in Europe and publishes its findings. Neither will have checked every crypto rumour. A search there still takes less time than writing a reply to the post.
Red flags that should stop you before you click
Some signals justify stopping on their own, before any other check:
- The only evidence is a screenshot, with no link to a document.
- An official account promotes a token its website does not mention.
- Someone famous offers to double the coins you send.
- A post asks you to connect a wallet, scan a QR code or enter a recovery phrase.
- The price moved hard and is already falling back while the story is still spreading.
- The text has no byline, no date and no label, yet reads like an advert.
Any one of these is a reason to wait and run the ten steps before you do anything.
Where the beginner path leads next
You have now finished Getting started: what a blockchain is, how coins, tokens, transactions and addresses work, which myths to drop and how to read what is written about all of it. The next step depends on what you plan to do. If you intend to hold any crypto, start the security path with our lesson on crypto wallets, because the scams in this guide all end with someone else holding your keys. If you are getting ready to buy, the buying path opens with how to buy crypto for the first time.
Before you open either one, set up your list. Bookmark the SEC newsroom, the FCA Warning List, ESMA’s MiCA page and a block explorer for the coins you follow. The next time a headline makes you want to act, open those four tabs first.
