Fake Crypto Accounts Push Scams on Bluesky
Bluesky’s open architecture has made it especially susceptible to fake crypto accounts abusing platform features to grow their own audiences.
TLDR
Bluesky’s popularity has made it a new frontier for online scams, with researchers noticing many accounts focusing on cryptocurrency-related fraud.
These accounts drive users to malicious websites selling crypto products or trying to obtain users’ personal details.
Bluesky’s open architecture could make it especially susceptible to the proliferation of inauthentic accounts.
Background
Bluesky has seen a nearly 1,000% increase in its user base over the past year as it has gained popularity.1 2 Users have flocked to Bluesky, viewing it as an alternative to X/Twitter.3 As its user base has grown, Bluesky has become a new frontier for online disinformation and scams, seeing a rise in inauthentic accounts.
Researchers took a closer look at some of the inauthentic accounts’ behavior and found that cryptocurrency (or “crypto”) focused accounts stood out, both for their prevalence and distinct engagement patterns. While not all crypto-related accounts on Bluesky engage in deceptive or click-baiting behavior, these accounts tend to stand out for:
Posting AI-generated images or “AI-slop” to generate an active posting history
Linking to malicious websites with promises of get-rich-quick crypto schemes or fake cryptocurrencies
Content Moderation Settings on Bluesky
These accounts likely benefit from Bluesky’s open architecture design. Bluesky is built on the authenticated transport (AT) protocol, which allows users to store their data on different servers. As part of its open architecture, Bluesky has created Ozone, an open-source content moderation interface. Ozone gives users the ability to set their own content moderation preferences by subscribing to a set of “labelers” that meet their own tastes.
New accounts on Bluesky are opted into Bluesky’s default content moderation settings,4 though they can opt out of these settings or customize their feed by adding or removing content filters. This approach is very different from most social media platforms, where strict content moderation systems—which also usually attempt to address malicious inauthentic behavior—are set from the outset by the platform and are significantly less customizable. Unless users explicitly seek out a labeler that blocks out crypto spam accounts, they are very likely to be exposed to said accounts.
The prevalence of these crypto accounts appears to be quite evident to users on the platform. Using the Search tool on the Open Measures platform and the term “crypto accounts”, we find results on Bluesky that show various users complaining about the presence of fake crypto accounts.
Analysis
New users on Bluesky who have not yet used any of the custom content moderation tools on the platform are more likely to be exposed to fake crypto accounts. To understand how popular crypto-related discussions are on the platform, researchers used Open Measures’ Timeline feature to search for posts on Bluesky using the following subset of popular crypto-related terms:
crypto, cryptocurrency, solana, bitcoin, xrp
The graph below demonstrates the frequency of posts referencing those terms on Bluesky over a 12-day period. The results show sustained interest in the topic.
Not all crypto-related accounts engage in deceptive or scam behavior and many posts appear to be from authentic accounts. However, a key element of fake or spam account behavior is if an account tries to drive users to malicious websites or solicit personal user information. Using the Link Counter tool, researchers pulled the top domains that appear in Bluesky posts that used the same subset of crypto-related terms previously mentioned.
Given the popularity of crypto, researchers expected to find crypto news outlets or exchanges as the most popular links. Instead, the top links were malicious websites with many pop-ups peddling obscure crypto tokens, adult chats, or links to other sketchy websites. These websites are pushing visitors to make purchases or to share personal information.
Below are screenshots of the top two websites researchers found after using the Link Counter tool:
Finally, below are example posts from some crypto-focused accounts on Bluesky:
Why is Bluesky Full of Fake Accounts?
All social media platforms face challenges dealing with scams and deceptive behavior. Bluesky is no different, especially as it has experienced a surge in popularity. Bluesky offers more control to users over their platform experience, allowing them to customize content moderation preferences and the platform’s open architecture allows anyone to build creative integrations. However, Bluesky’s open model might be making the platform more susceptible to these issues, at least in the short term, as the platform starts developing a significant user base. Bluesky has two platform design factors that might make users especially susceptible to exposure to malicious behavior:
Starter Packs
Bluesky starter packs are collections of recommended accounts that new users can follow when they first join the platform, usually curated by theme or issue.5 The purpose of starter packs is to help new Bluesky users overcome the “cold start” of an empty feed by offering relevant content quickly so users can build their feed around specific interests or issues.
Unlike “suggested accounts” offered to users when they create a new account on other social media platforms, starter packs allow users to follow tens or hundreds of accounts at once rather than individually following each account. When users choose a pack, they can follow all accounts in it with one click, thus minimizing friction and instantly populating their feed with content.
As starter packs allow users to quickly follow a large number of accounts, they are also a helpful tool for bot or inauthentic accounts looking to expand their reach on the platform. Accounts looking to appear popular will often follow a large subset of other accounts to encourage “follow backs”. A manual review of some of these suspicious crypto accounts found that they follow a similar subset of accounts, which could have been facilitated by the use of starter packs. By amassing huge user followings, these accounts can appear authentic, thus fooling users looking to follow relevant accounts.
Customized Moderation
Bluesky has open-sourced its content moderation system, Ozone, allowing anyone to create unique content moderation labels.6 Users on the platform can use those labels to customize their feed experience. The key aspect of this model is that it allows users to “shop around” for a content moderation model that fits their own preferences. Users can create a platform experience with minimal filtering or one with strict content moderation.
Unlike starter packs, which are immediately introduced to users when they create an account, customizing content moderation requires more tech-savviness on the user end. To use the interface effectively, users must first understand that custom content moderation is possible before proactively looking for “labelers” and selecting those that best fit their preferences, including those that label or block fake crypto accounts. For users migrating from other social media platforms with built-in content moderation, this is a process that requires more work on the user’s end.
Conclusion
The challenges of fake accounts are not new to social media platforms. Still, Bluesky’s design and open architecture present unique challenges. First, the starter packs offer fake accounts an endless supply of users to follow. Second, the complexity of its content moderation policy may potentially be exposing average users to content from malicious accounts.
As Bluesky's popularity surges, fake crypto accounts are adapting old spamming techniques to take advantage of the platform’s open architecture. These accounts leverage crypto-related keywords to push unsuspecting users to websites peddling obscure crypto tokens, adult chats, or links to other sketchy websites. Beyond cluttering feeds as spam, these accounts also expose users to potential financial fraud and identity theft.
As Bluesky seeks to establish itself as a viable alternative to centralized social media, maintaining the integrity of its open network will be crucial. In the meantime, understanding Bluesky’s open model design can help researchers better study the platform.
Identify disinformation and extremism with the Open Measures platform.
Organizations use Open Measures’ tooling every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops.
Rodericks, A. (2025, January 17). Bluesky 2024 moderation report. Bluesky. https://bsky.social/about/blog/01-17-2025-moderation-2024
Bluesky User Count. Bluesky User Counter. (n.d.). https://bsky-users.theo.io
AP News. (2024, November 15). What is Bluesky, the fast-growing social platform welcoming fleeing X users?. Associated Press. https://apnews.com/article/bluesky-x-twitter-dcc4f92f9d0386dbacc3f30376b38dbc
Bluesky’s stackable approach to moderation. Bluesky. (2024, March 12). https://bsky.social/about/blog/03-12-2024-stackable-moderation
Introducing Bluesky Starter Packs. Bluesky. (2024, June 26). https://bsky.social/about/blog/06-26-2024-starter-packs
Bluesky’s stackable approach to moderation. Bluesky. (2024, March 12). https://bsky.social/about/blog/03-12-2024-stackable-moderation.