Hacker Behind Fake 'Vladhood' Token Still Collecting Fees After Robinhood CEO's X Account Hack

Robinhood CEO Vlad Tenev's X account was compromised on Thursday and used to promote a fake memecoin on Robinhood Chain, the company confirmed. That’s the visible half of an operation that, onchain records show, was set in motion hours earlier and designed to profit from the frenzy without ever pulling liquidity.

"Heads up: Our CEO Vlad Tenev's X account was compromised and posted a fake promotion for a meme coin," Robinhood's communications team said in a post on X about 41 minutes after the promotion appeared. "We're working with X to restore access and the post has been removed."

The token, called Vladhood (VLAD), drew more than $22 million in trading volume and roughly 85,000 swaps in its main Uniswap pool in the hours after the post, according to DexScreener. It was trading at about $0.0026 with a fully diluted valuation of roughly $2.6 million as of 3:55 pm ET — down about 20% over the prior hour but still up more than 90,000% from launch. The contract counted 5,266 holders and over 137,000 transfers on Robinhood Chain's block explorer, which has labeled it a scam.

A Token Built for the Hack

The wallet behind Vladhood, 0xD706…438D, was created for the occasion. Onchain records show it received its only funding, 0.2955 ETH, at 11:25 am ET on Thursday from a wallet labeled on block explorers as the solver for Relay, a cross-chain bridging service, a route that obscures which chain the money came from.

At 12:38 pm ET, the wallet's first-ever transaction launched Vladhood through Pons, the busiest of the Pump.fun-style launchpads that have sprung up on Robinhood Chain. The launch parameters listed https://x.com/vladtenev — Tenev's X profile — as the token's official website. The fraudulent post went up on that account 46 minutes later, indicating the token launch and the account takeover were parts of a single coordinated operation rather than opportunists riding a hack.

The wallet did not need to pull liquidity to cash out. Pons locks a launched token's liquidity in a locker contract, but lets creators claim the trading fees their token generates.

Starting seven minutes after the fake post appeared, the wallet called the locker's fee-collection function six times over roughly two hours, netting about 31.6 ETH, worth roughly $59,000, plus about 72 million VLAD — around 7% of supply, worth about $188,000 at current prices — according to Blockscout data.

It then distributed the proceeds across three newly created wallets. Its most recent fee claim came at 3:33 pm ET, meaning the operation was still collecting as of press time — and because the liquidity remains locked, the token remains fully tradable despite the explorer's scam label.

'Welcome to the Hood'

The fraudulent post was written to read like a company announcement.

"Ahead of earnings, we've seen a lot of people asking… Does Robinhood love memes? The answer is yes," the post read, according to screenshots captured before it was deleted. "So today we're introducing Vladhood ($VLAD), the official Robinhood chain mascot."

The post claimed the token would "also be listed in the Robinhood app," included the token's contract address, and closed with "Welcome to the Hood," alongside a meme showing Tenev in a Robin Hood cap choosing between buttons labeled "MEMES" and "RWA."

The contract address in the post matches the scam-flagged Vladhood contract onchain. The post drew more than 175,000 views in under 20 minutes before users flagged it. About 30 copycat VLAD pools appeared within hours; at least three were drained to zero.

Third Incident in Three Weeks

The compromise is at least the third social media scam tied to memecoins on Robinhood Chain, the Arbitrum-based Layer 2 that Robinhood launched July 1 to host tokenized stocks and other real-world assets, and where memecoins have dominated activity since day one. Hijacked SpaceX and Starlink X accounts were used on July 12 to promote a Robinhood Chain memecoin that reached a $2 million market capitalization before its creators pulled liquidity. Days later, a viral X post claimed Tenev had leaked his wallet's seed phrase during a livestream — a claim that matched a honeypot pattern and was never corroborated.

The scams have done little to slow the network, which overtook Base in daily active users three weeks after launch.