Hackers Hijack Ireland's Garda X Accounts, Push Fake XRP Airdrop Scam to 900,000 Followers

Published October 15, 2026, 16:07 UTC. Based on reporting by The Irish Times (via Press Association) and RTÉ, as reported by BBC News.

Two official X accounts belonging to An Garda Siochana, Ireland's national police service, were hijacked overnight and used to push a fake XRP airdrop phishing campaign to a combined audience of more than 900,000 followers. The force confirmed the breach on October 15, 2026, saying it was limited to the X platform and that no Garda systems or data were affected.

The 900,000-follower hijack

The compromised accounts are @GardaTraffic, which carries roughly 600,000 followers and is used for traffic updates and road safety information, and @GardaInfo, with nearly 300,000 followers, one of the force's main public information channels, according to The Irish Times. The attackers gained unauthorized access during the night of October 14, stripped the official Garda branding from both profiles, and changed their listed location to Amsterdam in the Netherlands, scores of cryptocurrency posts began appearing on both timelines urging users to claim an XRP "allocation."

Some of the posts were flagged by X with warnings linking them to a suspended profile, The Irish Times reported, a label the platform applies when an account is tied to spam, malicious behavior or security risks. The fake posts remained live long enough to be seen by thousands of people before the platform removed them all.

Rebranded as a wallet support account

@GardaInfo was given new imagery and messaging presenting it as the support account for Xaman, formerly known as Xumm, a self-custody wallet built for the XRP Ledger, according to BBC News. The account's name was changed to a single full stop, and the posts promoting the wallet were removed along with the rest of the fraudulent content. @GardaTraffic kept part of its original biography describing it as the force's traffic and road safety account, even while the fake crypto posts sat on top of its timeline, older legitimate Garda posts remained visible further down.

The rebrand as a wallet support account is a classic phishing pattern: the posts offered an XRP "allocation" and pushed users toward links claiming rewards, setting up anyone who connected a wallet or approved a transaction to lose funds. The Irish Times noted the compromised X account is still linked to from the official Garda website, a detail that could keep directing unsuspecting visitors toward the hijacked profile.

The force warns the public: do not interact

An Garda Siochana said it is carrying out an internal investigation and is working with X to understand how the unauthorized access happened. The force said it is "satisfied that there is no unauthorised access with any Garda systems and that there is no loss or impact on any Garda data," and issued a direct warning: "An Garda Siochana is warning members of the public not to interact with any content posted on the @gardatraffic or @gardainfo X accounts, or accounts purporting to be these accounts."

The incident is the latest in a running series of hijacked high-profile social accounts used to seed crypto phishing campaigns, where attackers monetize stolen credibility rather than the platform's users directly. Anyone who interacted with the fake posts should revoke any wallet approvals they granted and treat any messages from the accounts as compromised.

This article is news reporting and is not investment advice.

Sources

• The Irish Times (additional reporting by PA), "Garda social media accounts promoting cryptocurrency were hacked, force confirms", October 15, 2026, primary source for the force's confirmation, the affected accounts, the follower counts, the internal investigation, and the public warning
• BBC News, via CryptoTimes.io, "Irish Police X Accounts Hacked to Promote XRP Airdrop Scam", October 15, 2026, secondary source for the Amsterdam location change, the Xaman wallet rebrand detail, and the XRP "allocation" lure
• Classic Hits Radio (reporting by RTÉ), "Garda Social Media Accounts Appear Hacked in Cryptocurrency Breach", October 15, 2026, secondary source for the force's statement that the breach was limited to X and that no Garda data was affected
• PANews, "Irish police X accounts suspected of being hacked, used to promote crypto phishing content", October 15, 2026, secondary source for the attack timeline (Wednesday evening) and the phishing content detail