On a grey Dublin morning, someone quietly edited the location field of An Garda Síochána's traffic account to read "Amsterdam." Six hundred thousand followers — commuters checking motorway closures, parents tracking the school run, night-shift workers scanning for road incidents — opened the app to find a timeline that no longer belonged to them. The official crest was gone. In its place, a funnel: crypto promotional copy, the kind written to feel urgent, the kind that asks you to click before you think.
I have spent thirteen years watching this industry build things and break things, and the loudest incidents are rarely the most instructive. This one is quiet. No depeg, no exploited contract, no nine-figure loss to gawk at. There is only a stolen badge — and the eight hundred and ninety thousand people who trusted it enough to believe whatever it said next. That is where the real story lives: not in how the accounts fell, but in what their fall reveals about the currency we never audit — institutional trust.
The anatomy of a hijacking
An Garda Síochána, Ireland's national police force, lost control of at least two X accounts in the same window: @GardaTraffic, with roughly six hundred thousand followers, and @GardaInfo, with nearly three hundred thousand. The BBC reported the incident while it was still unfolding — the force was still being asked for comment as the posts multiplied, which tells you something about the speed mismatch between an attacker and an institution.
Whoever did this held complete control, not partial. They stripped the branding. They changed the account's geolocation to Amsterdam. They posted. When you can remove a logo, edit a profile, and publish in sequence, you are not a nuisance with a stolen password; you are the account, wearing its face. Some of the posts were later flagged by the platform as linked to restricted or banned accounts — a detail I keep returning to, because it means the detection happened after publication, not before. The fraud had a head start measured in minutes. In scam time, minutes are fortunes.
Now, the intrusion vector is undisclosed, and I will not pretend to know it. But I have audited enough systems to reason about the shape of the wound. High-value official accounts are rarely broken by clever code; they are broken by people. The four recurring doors are SIM swapping — deceiving a carrier into porting a phone number so that SMS two-factor codes land in the attacker's hand — credential stuffing, where password pairs leaked from some unrelated breach are sprayed across logins until one sticks, OAuth token theft, where a third-party app's authorization becomes the skeleton key, and plain social engineering, sometimes against the account holder, sometimes against a platform's own support staff. The last one is the quietest and the most devastating. You can harden a server. It is far harder to harden a human being who wants to be helpful.
The simultaneous compromise of multiple related accounts points to something more organized than a lone opportunist. It suggests tooling — batch operations, templated rewrites, a workflow rehearsed until it runs without thought. This is the signature of an industry, not a hobby.
Trust as a transferable asset
Here is the part that deserves more attention than the hack itself. The attackers did not steal money. They stole credibility, and they spent it immediately.
Think of what a police account actually holds. It is not a database or a wallet. It is a claim on public belief — a standing assumption that what appears under this crest is true and safe. Economists have a word for that kind of accumulated belief: goodwill. Accountants put it on balance sheets and then struggle to value it. In the attention economy, it is the most valuable asset an institution owns, and the only one that can be transferred to a criminal in a single afternoon without a single ledger entry.
I want to name this precisely, because vague language lets us off the hook: what happened in Dublin was a trust-capital heist. The attacker liquidated a century of institutional legitimacy into scam traffic. The mechanism is simple and brutal. Borrow an authority's voice. Point its audience at a link. Watch the audience, trained since childhood to obey uniforms, comply.
The monetization path is well-worn. Hijacked high-reach accounts typically funnel followers toward phishing pages, fake token contracts, or giveaway scams — the "we're giving away crypto, send a little to receive a lot" theater that has separated the credulous from their funds for years. If a specific contract was promoted, my strong prior — and I flag it as a prior, not a fact — is that it was either a honeypot that permits deposits but blocks withdrawals, or a rug-pull token engineered to vanish once the liquidity looked appetizing. The final leg runs through wallet drainers, mixers, and cross-chain bridges that scatter the proceeds faster than any subpoena can follow.
The "business model," if the word deserves the dignity, is purely predatory. Almost one hundred percent of its revenue is victim loss. There is no product, no yield, no value creation — only a zero-sum conversion of someone's trust into someone else's theft. When people ask me why I remain skeptical of the reflexive "crypto is a scam" narrative, I point at incidents like this and say: look closely, because what you are seeing is not the technology. It is a criminal industry that has learned to weaponize the technology's vocabulary. The difference matters enormously, and it is the difference this article exists to preserve.
The industrialization nobody wants to admit
For years I have described the black market in stolen credentials as "crime as a service," and the phrase has aged uncomfortably well. There is an upstream, and it is professional. SIM-swap specialists rent their skills. Credential brokers sell access to accounts the way a wholesaler sells inventory. On the downstream, plug-and-play wallet drainers lower the technical bar until a scammer needs almost no skill — only a target and a template.
Between those two ends sits the hijacked account itself: the distribution layer, the trust amplifier, the piece that turns a criminal's message into a message a stranger will trust. The division of labor is the tell. The person who obtains the account may never meet the person who writes the promo copy, who may never meet the person who runs the drainer, who may never meet the person who launders the proceeds. Each sells a service to the next. The chain is modular precisely so that no single arrest can dismantle it.
And within that chain, an official law-enforcement account is the rarest, most expensive input of all. Its trust premium dwarfs a celebrity's or a brand's. A random influencer saying "buy this token" triggers skepticism. A police force saying it triggers a reflex of obedience that took generations to install. That is why these accounts are targeted, and it is why the targeting will continue.
The platform's blind spot
I do not want to turn this into a platform-bashing essay, because that is the lazy move and it obscures more than it explains. But there is a structural fact worth sitting with: the posts were flagged as connected to restricted accounts only after they went live. Detection was retrospective. For an institution whose entire value proposition to advertisers and users is that the verified badge means something, that is a wound.
Here is the counterintuitive part. We have spent a decade teaching users that a blue checkmark equals trust. We have built an entire verification economy on the premise that identity, once confirmed, stays confirmed. But identity is not a static property; it is a continuous state that must be defended every second. The checkmark certified who owned the account at the moment of verification. It says nothing about who owns it now. We have mistaken a photograph of trust for trust itself — and a photograph, as anyone who has watched a generative model work, is exactly the kind of thing that can be forged, stolen, or repainted overnight.
This is where the incident stops being about one police force and becomes about all of us. The attack surface is not a bug in X. It is the architecture of trust we have chosen: centralized, transferable, and defended mostly by a password and a promise.
The uncomfortable mirror
Now I want to offer the contrarian read, because the comfortable story — "crypto scammers embarrass police, platform fails again" — lets everyone off too easily, including the people who will nod along with it.
The deeper truth is that An Garda Síochána's account was not hijacked because X is weak or because cryptography failed. It was hijacked because institutional legitimacy, in the digital age, is a costume. A badge, a crest, a checkmark — these are symbols with no cryptographic binding to a human soul. Anyone who finds the zipper can wear them. The force did nothing uniquely negligent; it did what nearly every institution on Earth does, which is to trust that a password and a phone number are sufficient guardians of a reputation built over a century.
I find myself returning to something I wrote during the NFT years, when I traced a celebrated generative-art project's metadata to centralized servers and exposed how the promise of permanent, decentralized ownership was, in places, theater. The backlash was severe; some accused me of killing the culture. But a handful of developers wrote to thank me, because clarity — even painful clarity — is the only foundation anything durable can be built on. The same discomfort applies here. The lesson of Dublin is not that crypto is a scam. It is that every institution is running on trust it cannot cryptographically prove it still holds — and the criminals figured that out before the institutions did.
Yes, the scam content wore crypto's clothes. And yes, this will be cited by regulators and op-ed writers as further evidence that the whole space is rotten. But the rot, in this instance, is not in the protocol. It is in the credential — the paper badge, the SMS code, the checkmark — that we keep mistaking for proof.
What actually protects a name
The practical fixes are unglamorous and well understood, which is exactly why they are so often skipped. Hardware security keys, not SMS codes. Phishing-resistant multi-factor authentication that binds to the origin. The removal of third-party OAuth tokens that no one remembers granting. Real-time behavioral anomaly detection that notices when a fifty-year-old institution suddenly posts in a new voice from a new country at a new hour. And, above all, treating institutional accounts as critical infrastructure rather than as marketing channels.
But the deeper fix is philosophical, and it is the one I have spent my recent work arguing for. In 2026 I partnered with an AI content-verification protocol on a campaign for verifiable human identity — a manifesto I called "The Proof of Soul." Its central claim is simple and, I believe, increasingly urgent: in an age when synthetic media can imitate any voice and stolen credentials can wear any badge, cryptographic proof of identity is not a luxury. It is the last structural defense of human authenticity. A key held in a hardware device, bound to a person, cannot be socially engineered out of a support desk. A signed message cannot be faked by a stranger who borrowed a logo.
The Dublin incident is, in miniature, the argument for that future — made by its opposite. It shows what happens when identity is a claim rather than a proof. It shows how quickly a name, once detached from any cryptographic anchor, becomes raw material for whoever grabs it first. And it shows that the institutions most trusted by the public are, today, among the least technically armored.
Takeaway
So watch this story, but watch it for the right reason. The next disclosure will be whether the promo content pointed at a specific contract, whether on-chain victims appear, whether Europol or Ireland's regulators step in, whether other official accounts surface with the same wound. Those are the signals that matter — not the momentary outrage.
And while we wait, notice the asymmetry the whole episode exposes. We ask users to be vigilant, to verify, to do their own research. Yet the very authorities urging that vigilance cannot prove their own identity beyond a password. Until trust itself becomes something you can cryptographically hold — a key, a signature, a proof of soul — the badge will remain what it has always been: a beautiful costume, waiting for someone to find the zipper.
