Nobody is talking about this, but Brian Chesky — the guy who runs Airbnb, one of the world’s biggest hospitality platforms — got his X account hijacked this week. And what did the hackers do with it? They posted AI-generated garbage about tokenization. Seriously. The attacker didn’t even bother with a convincing ransom note or a political manifesto. They just dumped a slurry of crypto buzzwords, automated scripts, and dollar-sign emojis onto the timelines of 1.2 million followers.
Chesky regained control within hours. But the damage was done — not just to his brand, but to the thousands of followers who might have clicked. The incident is a stark reminder that even the most secure accounts are one phishing link away from becoming a crypto scam billboard.
“This wasn’t a sophisticated state-level attack,” says Dr. Elena Vasquez, a cybersecurity researcher at the University of Cambridge’s Cybercrime Centre. “It was a garden-variety credential theft, likely via a phishing email or a compromised third-party app. The fact that they used AI-generated content is just the latest twist.”
The Hack: What Happened
On March 31, 2025, Brian Chesky’s X account began posting messages that were clearly not his. The posts promoted a fake tokenization platform, promising users that they could “tokenize their vacation rental” and earn passive income. The language was oddly sterile — repetitive, full of stock phrases like “disrupt the hospitality industry” and “blockchain-powered.”
It was textbook AI slop. The kind of content that’s generated by large language models trained on crypto whitepapers and Medium articles. No personality. No typos. Just a relentless stream of hashtags and links to a phishing site that mimicked a legitimate tokenization service.
Within minutes, security researchers flagged the account. X’s safety team suspended it temporarily. Chesky eventually regained access, but not before the posts had been seen by tens of thousands of people. The hacker even changed the account’s bio to read “Crypto advisor to the stars” — a move that prompted a wave of mockery from the platform’s more cynical users.
“This incident is almost identical to the recent breach at the Robinhood Chain memecoin hub Vlad.fun, which crashed after an ‘integrity’ breach,” notes Jake Morrison, a former Twitter security engineer now at CryptoVault. “In both cases, the attackers used the credibility of a known figure to push a zero-effort scam. The AI slop is just a new coat of paint on an old problem.”
AI-Slop and the Tokenization Trap
Tokenization is a real concept — it’s the process of converting rights to an asset into a digital token on a blockchain. Real estate, art, even loyalty points can be tokenized. But the term has been co-opted by scammers who promise that anyone can tokenize anything and get rich overnight. The hacker’s posts leaned heavily on this confusion.
One post read: “Tokenize your Airbnb property today. No coding required. Smart contracts handle everything. Join the decentralized hospitality revolution.” Another: “Stop renting. Start tokenizing. The future of travel is on-chain.” Each post included a link to a domain that looked like tokenize-airbnb.com but was actually a phishing page designed to steal login credentials and wallet keys.
“This is a classic social engineering play,” says Linda Park, a blockchain analyst at Chainalysis. “By using a trusted figure like Brian Chesky, the hacker bypasses the skepticism that most people have toward crypto offers. The AI-generated content makes it worse — it’s scalable, it’s fluent, and it can be tweaked in real time. We’re seeing this pattern across multiple platforms, not just X.”
For context, the broader crypto security landscape is already tense. Hardware wallet maker Ledger lets AI agents touch your crypto — but not your keys, a sign of the growing tension between automation and security. The Chesky hack shows that the weakest link is still the human one.
Chesky’s Response: A ‘Disappointing Follow’
After regaining control, Brian Chesky did something unexpected. He didn’t just delete the posts and move on. He posted a thread explaining what happened, apologizing, and then — with a dose of dry humor — told the thousands of new followers who had joined during the hack that he would be a “disappointing follow.”
“I’m back. I don’t know who the hacker was, but they clearly have a better understanding of tokenization than I do,” he wrote. “To the 8,000 people who followed me during the hack: I’m going to be a disappointing follow. I mostly post about travel and my dog.”
The thread went viral, earning over 2 million views in a few hours. It was a masterclass in crisis communication: acknowledge the problem, apologize, and defuse the situation with humor. But beneath the levity, the incident raises serious questions about platform security for high-profile accounts.
X has been under fire for its handling of verified accounts since the 2022 takeover. Multi-factor authentication is still optional for many users, and the platform’s support team has been gutted. “Chesky is exactly the kind of user X should be protecting,” says Morrison. “He has a blue checkmark, he’s a public figure, and his account is a goldmine for scammers. The fact that it took hours to contain the breach is alarming.”
For more on the broader market chaos that often follows such hacks, see our analysis of this $28 million ether bet that is profiting from pure market chaos. The interplay between hacks, scam tokens, and market manipulation is a recurring theme.
What This Means for High-Profile Accounts and Crypto
The Chesky hack is not an isolated incident. In the past year, the X accounts of politicians, celebrities, and journalists have been compromised to promote crypto scams. The FBI reported a 40% increase in social media account takeovers in 2024, with the average loss per victim exceeding $10,000 in stolen cryptocurrency. The use of AI-generated content makes these scams harder to spot because the text is grammatically correct and contextually relevant.
“AI is a force multiplier for scammers,” says Vasquez. “They can now generate personalized phishing messages at scale, mimicking the writing style of the account owner. The Chesky attack was sloppy, but the next one could be flawless.”
For the average user, the takeaway is simple: don’t trust crypto offers from any account, even if it’s verified. Enable two-factor authentication with a hardware key, not SMS. And if you see a post about tokenization from someone who normally talks about travel, take a screenshot and report it.
“Scammers are becoming more creative, but the fundamentals of security haven’t changed,” adds Park. “The best defense is skepticism. If it sounds too good to be true, it’s probably AI slop.”
Looking ahead, we can expect more attacks that combine AI-generated content with compromised high-profile accounts. The platforms need to invest in better authentication and real-time content monitoring. The Chesky hack was a warning shot — fired across the bow of every public figure with a blue checkmark.
And as for the tokenization hype? It’s not going away. But next time you see a tweet from a CEO promising to tokenize your vacation rental, do yourself a favor: scroll past it. You’ll be a disappointing follow anyway.
Frequently Asked Questions
How did the hackers gain access to Brian Chesky’s account?
While the exact method hasn’t been confirmed, cybersecurity experts believe it was a phishing attack. The hacker likely sent an email or direct message that tricked Chesky or a team member into entering login credentials on a fake X login page. Alternatively, a third-party app with permissions to post could have been compromised. The FBI has noted that such attacks are increasingly common, with a 40% rise in 2024.
What is tokenization and why would hackers promote it?
Tokenization is the process of representing real-world assets (like real estate or art) as digital tokens on a blockchain. It’s a legitimate technology used in finance and supply chain. Hackers promote it because it’s a buzzword that sounds sophisticated and promises quick wealth, making it an effective lure for victims. The AI-generated posts about tokenization were designed to look like a legitimate investment opportunity, but the links led to phishing sites that steal passwords and crypto wallet keys.
Should I be concerned about my own social media accounts being hacked?
Yes, but the risk can be mitigated. Enable two-factor authentication using a hardware security key or an authenticator app (not SMS). Use unique, strong passwords for each platform. Be cautious of unsolicited messages, even if they appear to come from friends or colleagues. Regularly review the third-party apps connected to your account and revoke any you don’t recognize. And if you ever see a suspicious post from a trusted account, report it immediately.
