EXCLUSIVE: X says ex-manager took $12,000 in crypto and bribed employee to restore scam accounts
A previously unreported lawsuit describes an unofficial market for bans, recoveries and valuable usernames. New discovery filings show how far the alleged backchannel may have reached.
By Ryan Merket · Published · Updated
Scoop: RuntimeWire original reporting.
Why it matters
Crypto projects depend heavily on X for identity and distribution. If proven, the alleged scheme shows how paid internal access could restore scam accounts or redirect valuable handles.
At 10:38 p.m. on New Year's Day 2025, Erick McAfee was nearing the end of his last day at X. He had given notice a month earlier. Before he left, according to a lawsuit filed by the company, the senior manager emailed himself a list of contact information for members of his team.
On its own, the act might have passed for the ordinary housekeeping of a departing executive. X says the list included subordinates who had helped McAfee with a contested transfer of the username @agent and with other account requests that the company believes he submitted for outsiders. In the weeks that followed, X alleges, McAfee used those relationships to keep reaching into the platform after his own access had been cut off. He contacted former subordinates daily. He passed one employee's private contact information to an executive at Paradox Research. He eventually paid another X employee between $250 and $500 per account to seek the restoration of fraud-related and crypto-scam accounts, the complaint says.
X also alleges that McAfee received three Ethereum payments worth approximately $12,000 while he was still employed, on dates when he routed requests through internal channels for accounts outside his client portfolio. The company says it believes he received further undisclosed compensation.
The allegations appear in a lawsuit X filed in San Francisco Superior Court on April 23, 2025, against McAfee, Jeremy Munger and Munger's company, Brain Chain LLC. The case appears to have gone unreported. It reemerged this summer through a discovery fight that has produced a list of Brain Chain clients, references to payments connected with dozens of X accounts, and a judge's finding that Brain Chain's initial responses to X were “patently deficient.”
No court has determined that McAfee accepted bribes, that Munger paid him, or that either man manipulated an X account. The defendants are contesting X's case, and the lawsuit remains scheduled for trial in February 2027. The July 29 ruling concerns Brain Chain's conduct in discovery. None of the organizations newly identified as Brain Chain clients should be understood to have participated in the alleged scheme simply because they appear in a discovery response.
What the record does offer is a rare view of the human machinery behind a global platform: the private messages, trusted employees and escalation tickets that decide who may speak through a valuable account. X's case describes what can happen when access to that machinery itself becomes a service for sale.
“A direct way”
McAfee joined Twitter in 2017 and rose to senior manager of client solutions, according to X's complaint. His job involved large advertisers: managing relationships, developing revenue strategies and helping clients solve problems. That role gave him access to advertising budgets and an intimate understanding of the company's systems for account suspensions, recovery requests, internal escalations and username assignments.
The authority was largely bureaucratic. McAfee could not necessarily flip every switch himself. He knew which team could, how to make a request legible to that team, and which facts would cause a ticket to move.
Munger approached that bureaucracy from the outside. In July 2024, the complaint says, he contacted one of McAfee's subordinates and suggested that his clients would spend $50,000 a month advertising on X. Munger also claimed that he had been working with the company's safety and security teams “behind the scenes” to watch Telegram channels and address scam or bot accounts.
The subordinate brought the request to McAfee, and the three men held a call on July 23. Afterward, Munger emailed McAfee with what he wanted: “a direct way to get accounts banned, or at least streamlined,” plus an escalation route through Telegram or Discord. He sought help banning accounts, returning compromised accounts to clients and moving problems around the ordinary support queue.
Some of those services have an obvious legitimate use. Crypto companies routinely contend with impersonators, phishing operations and account takeovers. A hacked account can place customers' money at risk. Brain Chain would later describe its work as gathering handles, email addresses and support-case numbers from account owners; relaying them to X personnel; and carrying the response back. It says it helped report compromised accounts, scam accounts, phishing, impersonation and suspicious activity. It also assisted with suspension appeals, Verified Organizations questions and username transfers.
That account places Brain Chain somewhere between a security fixer and a persistent concierge. X describes a darker arrangement. According to the company, Munger sold access to McAfee, and McAfee used internal systems intended for established clients to serve outsiders who were paying Munger. X alleges that many of the accounts were scammers, suspended fakes or participants in platform manipulation. It says Munger had been contacting other X employees since at least August 2023, sometimes presenting his outreach as an attempt to report malicious accounts.
The distinction matters because the action is often identical at the ticket level. A request to restore a compromised account may return it to its owner or hand it to an impostor. A report of a scammer may protect users or remove a rival. The person reviewing the ticket has to trust the identity of the client, the story attached to the account and the employee who brought it forward.
In X's telling, McAfee's value to Munger came from knowing how that trust was assigned.
The price of @agent
Usernames on X are both labels and property-like assets, although the company maintains that it owns them. Short, generic handles can confer instant credibility and are scarce by design. X now operates an official Handle Marketplace, where eligible subscribers may request select inactive handles and, for some, pay a transfer fee. The license remains revocable, and X says it may reclaim a handle.
The events in the lawsuit predate that marketplace. They show that X already had an internal process for pricing and transferring certain usernames. The alleged fraud concerned who was really buying one, and why the request deserved approval.
X suspended the original @agent account on November 22, 2024, for what it described as username stealing, trading and other platform manipulation. When McAfee asked why, an internal team told him the account had committed severe authenticity violations and declined to lift the suspension.
On December 11, according to the complaint, McAfee asked a subordinate to seek a price for the handle. The ticket said an established major corporate advertiser wanted it. X alleges that the request included the advertiser's internal ID, an employee's email address, a claim that the buyer was verified, and a statement that the buyer had purchased $250,000 in advertising during the preceding six months.
Minutes later, the subordinate resubmitted the request with much of the same information. One detail had changed: The corporate employee's email address was replaced with an address connected to Paradox Research.
X says McAfee kept referring to the established advertiser as the client. The internal team approved the transfer on that understanding. Behind the ticket, McAfee sought information about Paradox from Munger. On December 19, Paradox managing director Bennett Quintard emailed documents to McAfee and referred to Munger's role in the request. McAfee then directed X to send the invoice to Quintard. When Quintard said he had paid and asked about next steps, McAfee replied and blind-copied Munger, according to the complaint.
Quintard created a fresh account called @Agent_1618 on December 26. X transferred @agent to that account the next day, believing it was acting for the large advertiser. The new account was suspended on January 1 for suspected manipulation. McAfee, still employed that day, escalated the matter again and described the account holder as his client.
X's own employees approved the transfer and issued the invoice. That detail is central to both sides' theories. For X, the approvals show how false corporate information allowed McAfee to deceive colleagues. For Munger and Brain Chain, the fact that X personnel performed every account-level action separates their communications from the decisions that produced the alleged harm.
Three transfers of Ethereum
The money trail described in X's complaint is precise in timing and vague in origin. X says McAfee received Ethereum on December 7, December 9 and December 19, worth about $12,000 after conversion. Those dates corresponded with internal escalations he made for accounts outside his assigned portfolio, the company alleges. The original complaint does not identify the sender of each transfer or disclose the wallet addresses used.
X says the conduct continued after McAfee left. On January 3, one of his former subordinates submitted another ticket for @agent, writing that the client had purchased the username and was now locked out. An internal investigation connected the new owner with an account that X says had acquired the handle illicitly earlier in 2024. The company kept the account suspended.
According to the complaint, the subordinate shared that conclusion with McAfee, along with private contact information for an internal support employee. Quintard later contacted that employee directly. X says McAfee continued to ask former subordinates to escalate other accounts without telling them he represented outsiders.
The most serious allegation is contained in a single paragraph. McAfee “contacted and bribed another X employee,” the complaint says, paying $250 to $500 for each account that employee routed to internal support. X alleges that the requests included unbanning fraud-related and crypto-scam accounts and granting access to people McAfee selected. The company does not name the employee, identify the affected accounts or say whether it referred the matter to law enforcement.
The complaint seeks unspecified damages, restitution, disgorgement and punitive damages. It accuses McAfee of breaching his duty of loyalty and employment agreements, and of helping former subordinates breach their own duties. X sued Munger and Brain Chain for aiding and abetting McAfee and for violating X's user agreement.
X's first amended complaint, filed July 20, 2026, adds a restitution claim against Munger and Brain Chain. Its factual account is almost word-for-word identical to the April 2025 pleading. The court had allowed the amendment eleven days earlier, observing that it did not change the “tenor” of the case.
That history is important for understanding the news in the new filings. X made its accusations about bribes, Ethereum and @agent fifteen months ago. This summer's record adds names and possible scale.
The client list
In March 2026, X asked Brain Chain to identify every service it had provided relating to X, every client it had served since 2023, and every bank account, cryptocurrency account or payment method it had used for that work.
Brain Chain's first answers were sparse. It said that it had sometimes helped third parties with account support and directed X toward document productions rather than providing a complete list of clients and payment accounts. After weeks of letters and a motion to compel, Brain Chain served supplemental responses covering the narrower period from November 1, 2024, through January 31, 2025.
The response listed seven “clients, customers, or client/customer matters” for which Brain Chain said it provided or attempted to provide X-related services:
- Renzo Protocol and co-founder Lucas Kozinski;
- MetaMask and co-founder Dan Finlay;
- Paradox Research, Bennett Quintard and
@agent; - AllianceDAO, now known as Alliance;
- XAI Games;
- Defined.fi; and
- Church of the SCF.
Several are prominent crypto organizations. MetaMask, developed by Consensys, said last month that its wallet had surpassed 100 million downloads. Alliance operates a crypto and fintech accelerator. Renzo develops decentralized-finance products, and Defined.fi runs an on-chain trading and analytics service.
The list carries a crucial limitation. Brain Chain did not say that each client sought an improper account action. Its services included reporting scams and securing hacked accounts. X's complaint does not accuse MetaMask, Renzo, Alliance, Defined.fi, XAI Games or Church of the SCF of knowing about payments to McAfee or participating in the alleged misconduct. Paradox and Quintard are the only listed client and executive directly tied to the @agent allegations.
The supplemental response also reveals how incomplete the historical record may be. Brain Chain said it did not maintain a client list, customer-relationship database or ledger mapping clients to X handles. Some one-off conversations took place in Telegram chats configured to delete automatically. Other discussions with X personnel may remain in X's own direct-message system.
Its payment records were similarly fragmented. Brain Chain said Munger used separate wallet addresses for individual clients so that their funds would not be commingled. It identified one checking account, self-custody wallet software and four Ethereum-compatible addresses that may have been involved in receiving or sending value for X-related services. It also said it had no central accounting that connected every client payment with a handle, support matter or payment to McAfee.
In a footnote in its opposition to X's discovery motion, Brain Chain said X's lawyers had acknowledged receiving documents by December 2025 showing that Munger “received payments from clients relating to more than 75 different accounts.” That figure is an assertion in a defense filing, offered to argue that X had delayed seeking an amended complaint. The underlying payment documents are not included in the public filings reviewed by RuntimeWire, and a reference to an account does not establish that the account owner was a Brain Chain client or that the request was improper.
The number nevertheless changes the dimensions of the dispute. X's complaint tells one detailed story about @agent. Discovery appears to concern a much larger body of account work, much of it still unmapped.
What Brain Chain says it was selling
Brain Chain rejects the premise that it possessed an illicit control panel. Its supplemental response says it had no access to X's internal systems and could not lock, unlock, recover, suspend or transfer an account. Its work consisted of gathering information and communicating with support channels or individual X employees. Any platform action was performed by X staff.
That defense focuses the case on knowledge and intent. Munger and Brain Chain have moved for summary judgment, arguing that X lacks evidence they knew McAfee would violate duties to his employer, substantially assisted a breach, caused X's losses or formed an enforceable contract with the platform. A transaction record can show that money moved, their lawyers argue; it cannot by itself establish what Munger knew about a particular request.
The defendants have also accused X of using the discovery dispute to delay their summary-judgment motion. Brain Chain says it offered to supplement its responses and served them two days after X moved to compel. X says Brain Chain had already refused to amend, waited weeks to schedule a call, and then offered only a vague commitment as X's filing deadline approached.
Judge Christine Van Aken sided with X on the initial responses. At a July 29 hearing, she found that Brain Chain had failed to provide complete, non-evasive answers and that its refusal or failure to amend them lacked substantial justification. She ordered Brain Chain to pay X $3,000, far less than the $20,256.35 X had sought in fees.
The judge has not yet decided whether Brain Chain's supplemental answers are sufficient. She ordered another round of discussions and continued that portion of the motion until August 28, warning that either side could face further sanctions if its position lacks substantial justification.
The ruling says nothing about whether X's underlying allegations are true. It does establish that the public record is still being built, over resistance, and that the court found Brain Chain's first attempt at disclosure inadequate.
The market inside the platform
For most users, platform support is a form, a queue and an automated reply. Large advertisers inhabit a different system. They have account teams, internal advocates and escalation paths. The complaint suggests that X used an advertiser's identity, verification status and recent spending as signals of trust when deciding whether to release @agent. McAfee allegedly knew enough to borrow those signals for someone else.
That is the institutional weakness at the center of the case. A platform can harden passwords, log internal tickets and prohibit username trading. It still depends on employees making exceptions for people who have lost access, companies confronting impersonators and customers important enough to receive human attention. Every exception requires discretion. Discretion creates an opening for influence.
In crypto, control of a social account can carry immediate financial consequences. In January 2024, hackers seized the SEC's X account and falsely announced approval of bitcoin exchange-traded funds. Bitcoin rose by over $1,000 before the SEC corrected the post, then fell by over $2,000, according to the Justice Department. In 2025, the FBI recorded $7.2 billion in reported cryptocurrency-investment fraud losses. The agency separately counted approximately 4,700 account-takeover complaints with $359.7 million in reported losses.
Those figures do not bear on the guilt of anyone in X's civil case. They explain why a request to recover, suspend or transfer an account can be worth money, and why crypto firms may seek help outside a slow support queue. The person offering that help may be protecting a company from a thief. The same route can give a thief an aura of institutional approval.
X's current Handle Marketplace formalizes part of this demand. It permits transfers under rules the company can audit, price and revoke. The alleged arrangement in this lawsuit ran through personal relationships, private chats and the credibility of an employee whose colleagues trusted his account of the customer.
McAfee has filed an answer and a cross-complaint against X and X.AI Holdings, according to the court docket. The filings reviewed for this report do not contain his detailed account of the events. Munger and Brain Chain's court papers provide the fullest defense now in the public record: They say Brain Chain relayed support requests, X's own personnel made the decisions, and the payments X is pursuing cannot establish corrupt intent without a link to a specific wrong.
RuntimeWire sent detailed questions before publication to X, McAfee, Munger and Brain Chain, MetaMask, Renzo Protocol, Defined.fi and XAI Games. Responses received after publication will be added. RuntimeWire could not immediately identify verified email contacts for Paradox Research, Bennett Quintard, Alliance or Church of the SCF.
The remaining discovery may show whether X can make those links. The company wants a fuller client list, a fuller account of the services Brain Chain provided and a traceable record of the money. Brain Chain says parts of that record never existed, were automatically deleted or sit inside X's own systems.
The case began with a one-word username and a support ticket that carried the credentials of the wrong customer. It now asks a larger question about who governs a platform when its official channels are too slow, too opaque or too unequal for the people who rely on it. An unofficial broker becomes useful because he knows a person. The insider becomes valuable because his requests look official. By the time the platform recognizes the pattern, the transactions are scattered across direct messages, expiring chats, internal tickets and cryptocurrency wallets.
The service being sold, in X's telling, was access to someone who could make the system believe a story.
Supporting sources
X Handle Marketplace — X Help Center https://help.x.com/en/using-x/x-handle-marketplace
Guilty Plea in Hacking of the SEC’s X Account That Caused Bitcoin Value Spike — U.S. Department of Justice https://www.justice.gov/usao-dc/pr/guilty-plea-hacking-secs-x-account-caused-bitcoin-value-spike
2025 IC3 Annual Report — FBI Internet Crime Complaint Center https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
MetaMask Marks 10 Years as the Wallet That Made Self-Custody Possible — MetaMask https://metamask.io/news/metamask-10th-anniversary
Alliance | Crypto & Fintech Accelerator — Alliance https://alliance.xyz/
Defined.fi Documentation — Defined.fi https://docs.defined.fi/
Renzo Protocol Documentation — Renzo https://docs.renzoprotocol.com/