I Made A Bet With Ripple’s CTO, David Schwartz

Dissecting a key (Twitter) account from the XRP Army

16 min readAug 28, 2018

Network graph representation of Twitter accounts connected to @GiantGox. Each dot is a Twitter account which is following and/or being followed by @GiantGox (graph contains 39,131 accounts). Graph credit: Andy Patel

Enter @XRPTrump

Ryan Selkis’ Twitter account had been hacked the previous day. Two days prior to that, Laura Shin tweeted a link to an episode of her podcast (Unchained) where she was joined by Ryan and Matt Leising:

This was my first experience observing the XRP Army on the attack. To get a better sense of what that entails, I would encourage you to scroll through the replies to Laura’s tweet (there are hundreds!). I have included a few of those replies below:

On May 10th, 2018, Ryan shared some thoughts re: XRP/Ripple:

Ripple’s CEO, Brad Garlinghouse, replied (almost immediately) with this tweet:

Ryan’s Twitter account was hacked at some point later that day. Given the timing, I can totally understand why he would suspect that XRP was behind this attack:

Intrigued, I decided to acclimate myself with the XRP Army:

Later in the thread I highlighted 100+ accounts which contain “XRP” or “Ripple” in their usernames:

XRP-supporting accounts chimed in with questions about the graph/data and to state they know some/most of the accounts:

I would soon learn that two core members of the XRP Army/community are @haydentiff and @XRPTrump. Despite my best efforts, members of the XRP Army have always twisted my words.

Fortunately, it seemed that @XRPTrump — an anonymous account which is highly knowledgeable re: XRP/Ripple —was (finally) interpreting my words based on what had actually been stated:

I was encouraged by the change in their tone (see below tweet) and opted to continue the discussion via Twitter DM:

The Calm Before The Storm

Later that same day, @XRPTrump suggested that I “[come] forward with a list of people that [I am] confident [are] bots and share with Tiffany [@haydentiff] and [him] privately” (side note: between May 11th and Jul 14th, 2018, I traded quite a few DMs with @XRPTrump; discussion was always civil):

That exchange took place while my Twitter account was getting bombarded by the XRP Army (for tweeting this graph and data earlier that day). Hence, I was in no rush to identify/share accounts with @XRPTrump (even privately) which I was confident were fake/bot accounts, as I wanted to halt the attack (rather than prolong it).

Instead, I would later share a handful accounts with @XRPTrump, which, to me, appeared suspicious. I never stated that I was confident they were bots, although the XRP Army would later twist my words (they love to gaslight!).

Two of those accounts — namely, @Ripple_Expert (username has since been changed to @California_luve) and @xrptips (58.6K followers) — were presented to @XRPTrump on May 15th, 2018:

@Ripple_Expert had a substantial following (23.2K followers) and only followed 171 accounts. One of those accounts happened to be @XRPTrump:

@Ripple_Expert has since changed their username to @California_luve; screenshot from May 15th, 2018; at that time, @XRPTrump was one of 171 accounts being followed by @Ripple_Expert

When asked, @XRPTrump stated they were not familiar with @Ripple_Expert, yet they engaged with the account (@California_luve below) on Jan 26th, 2018:

Above @XRPTrump likes a tweet from @California_luve

Although @XRPTrump wasn’t quite to the point where they were ready to acknowledge the presence of fake/bot accounts, they certainly appeared to be warming up to the idea:

In fact, on July 13th, 2018, @XRPTrump even shared two accounts which they referred to as being “very dodgy”:

I didn’t actively pursue proving to @XRPTrump (or others from the XRP Army/community) that there are large numbers of fake/bot accounts which support XRP/Ripple, because, frankly, it requires lots of work.

About 6 weeks ago, however, something happened that compelled me to finally take on this task.

Enter @JoelKatz

On Jul 14th, 2018 (the day after @XRPTrump shared what he referred to as two “very dodgy” accounts with me), I resurfaced some older tweets, retweeting the previously mentioned graph and data tweets.

Immediately, @haydentiff — who was following my account at the time — replied to the (two-month) old thread with the following:

Note the surge of (fake) followers above @haydentiff’s reply/retweet

Within minutes, my Twitter account was being hit with fake followers. Given the timing, I (naturally) suspected the XRP Army was behind it. Shortly thereafter, I went ahead and shared what was happening with a friend, Mike Dudas, who I knew similarly has had his fair share of dealings with the XRP Army.

When I next grabbed my phone, I noticed there were a ton of Twitter notifications. After seeing this tweet from Mike, it all made sense (side note: thanks for throwing me under the bus, Dudas!):

Ripple’s CTO, @JoelKatz, who is very active on Twitter, joined the discussion this go-around. On the one hand, David expressed cynicism re: XRP/Ripple fake/bot Twitter accounts (“seems like a crazy conspiracy theory to me”); on the other hand, he didn’t rule out the possibility (“I don’t doubt that some number of fake/bot accounts exist”):

David was kind enough to agree to a silly little bet I proposed: if I can prove that XRP/Ripple fake/bot accounts exist, then he has to change his profile image to a robot (if I can’t, then I have to change mine to the XRP logo)

Thanks to @XRPTrump for the suggestion (re: @GiantGox)!

Profile of @GiantGox (August 26th, 2018)

Dissecting @GiantGox

Before we jump into the network graph, let me explain what we’ll be reviewing.

When the data was collected (July 21st, 2018), @GiantGox was following ~19K accounts and had ~36K followers. Each dot/node in the graph represents an account which was following and/or was being followed by @GiantGox at that time. Most accounts which were being followed by @GiantGox were also following @GiantGox (there were ~3K accounts followed by @GiantGox which were not following back).

To refresh your memory, here’s the network graph representation of Twitter accounts connected to @GiantGox (graph contains 39,131 nodes/accounts; first includes edges, second does not):

Colors represent communities (determined by interconnectedness) and the size of each circle represents how central the follower/account is in the community. Each line/edge represents a connection (follower/following) between accounts.

Here’s a high-level overview of the data, broken out by modularity class/communities:

39,131 accounts, of which, 36,319 were following @GiantGox (“@GiantGox followers” above)

Here’s some additional information to keep in mind as this review continues. We’ll discuss in more detail later in the post:

Limited to the 36,319 nodes/accounts which were @GiantGox followers (“@GiantGox followers” above)

Now, let’s work our way from the largest to smallest community. This will help us understand the types of accounts which are connected to @GiantGox (the account, according to @XRPTrump, is “the biggest one” from the “Japanese swarm”)

Modularity Class = 0

There are 15,659 nodes/accounts in this mod class/community:

Make note of the @emy_wng account (top left) as we’ll come back to it later (also viewable above: @warpaul, @XRPTrump)

Combined, the two largest clusters contain ~4.8K accounts which follow @GiantGox

(Closer Look) Notable accounts visible above include: @XRPTrump, @warpaul, @ashgoblue, @XRPSPEED, @XTRA_HRDCOR_XRP, @DennisRossdale, @Blockchainmove, @ekpethedragon, @CryptoCoinMaps, @Rafevo, @_mars75

Here are some of the most connected accounts from mod class = 0 which are followers of @GiantGox (65% have language set to Japanese; 28.6% English):

Accounts include: @emy_wng, @JoelKatz, @xrptips, @haydentiff, @Hodor7777, @XRPTrump, @devnullius, @XRPstreetTEAM, @TBCrypto, @BankXRP, @HaraldoXRP, @ToshiDesk, @BMBC_online_inv, @777trillionaire, @TplusZero, @nuonrg, @marcus_treacher, @kieranmlkelly, @XRPtheone, @xrp_news

What immediately stands out about this community are the number of densely populated clusters.

The largest cluster contains ~3.7K fake/bot accounts which follow @GiantGox:

Here are some of the accounts included in the largest cluster:

Accounts include: @xrp_trx_nem_, @xrpxrpxrpxr, @5O8KAfKWhOVWOIz, @QfTPKSmpr7DWElW, @XMYLVNqHBZFGaGs, @G63911atAntibes, @176cm67kg, @pz7v9mZnuXBTBVV, @22tama22tama22, @ss1121

The second largest cluster contains ~1.1K fake/bot accounts which follow @GiantGox:

Second largest cluster from mod class = 0

Here are some of the accounts included in the second largest cluster:

Accounts include: @xxxboxxxzero, @takahiro_xrp, @xrp2me, @EthereumRipple, @jaydarippler, @JAM27510, @SJfNw7WEmRZ8x81, @ryujisnote, @v7gld3bP82jmoxy, @sooh__

Outside of the clustering, accounts which are part of this community include key members of the XRP Army (@xrptips, @haydentiff, @Hodor7777, @XRPTrump, and @BankXRP to name a few):

Notable accounts visible above include: @XRPTrump, @warpaul, @haydentiff, @justmoon, @Hodor7777, @CoryTV, @BankXRP, @PonderJaunt, @DigitalAssetXRP, @XRPstreetTEAM, @XRPedia, @Ripplenews_tech, @xrp_news, @RippleFeed, @XRPtheone, @xrpsymbol, @Coil, @RippleXRPbot

Closer look at accounts surrounding @Hodor7777 (notable accounts visible above include: @chrislarsensf, @marcus_treacher, @CoryTV, @Interledger, @nbougalis, @JedMcCaleb, @ErikvanDijk, @TplusZero, @MummyVx2, @RXRPhodler, @kh_crypto, @jake_on_rocks, @PacVotan, @Rippleidol, @CNHoldings)

Accounts which are part of this community also include many Ripple employees (@emy_wng, @warpaul, @ashgoblue, @justmoon, @nbougalis, @CoryTV, and @marcus_treacher can be seen in the above images, for example). Worth noting, however, that Ripple’s official Twitter account (@Ripple) is not part of this mod class/community.

Captured below are @bgarlinghouse (Ripple’s CEO) and @JoelKatz (Ripple’s CTO). Note that their node color is violet, yet the accounts are surrounded by nodes that are green (same holds true for @emy_wng):

Can you spot @bgarlinghouse and @JoelKatz?

This community (mod class = 0) is comprised of 14,397 accounts which are followers of @GiantGox. Included among those nodes/accounts are several large clusters (the largest two contain ~4.8K fake/bot accounts which follow @GiantGox), key members of the XRP Army, and a number of Ripple employees (and Ripple-affiliated entities).

Within this community, ~65% of accounts (9,361) have their language set to Japanese (vs. modularity classes 1, 2, and 4, for comparison, where that number is closer to 90%) and ~29% (4,124) have it set to English (vs. modularity classes 1, 2, and 4, for comparison, where that number is closer to 10%).

Modularity Class = 2

There are 12,049 nodes/accounts in this mod class/community:

Notable accounts viewable above include: @emy_wng (mod class = 0), @crypto_child, @eddie_GTR_xrp, @lovexrp, @QUOINE_Japan, @kazu_kabuki_kaz, @digitlasset_xrp, @tyandooo, @uhauhauhasan, @cryptosshi, @bitmilkCurrency, @NyantaAltMooner, @notequalff, @bitcoininfo520, @virtualcoinlife, @cancan___can, @hqhfluck17

@emy_wng straddles the two largest communities (mod = 0 and mod = 2)

Here are some of the most connected accounts from mod class = 2 (87.9% have language set to Japanese; 11.9% English):

Accounts include: @bibiripple, @cryptosshi, @digitlasset_xrp, @uhauhauhasan, @xrp_is_future, @cancan___can, @bit_cafe2017, @eddie_GTR_xrp, @coin_agency, @xrpjp

Here are some of the larger accounts (based on follower count) from this community which contain the words “XRP” or “Ripple” in their bios:

Accounts include: @ripplove_mi, @kazu_kabuki_kaz, @crypto_child, @nem581226, @NyantaAltMooner, @muhoudemunou, @ykahaguka0633, @you_are_chin, @kasouhirosi, @kasoutsuka_

Before discussing @emy_wng in more detail, let’s first take a closer look at some of the nodes/accounts in this community:

This mod class contains the largest number of accounts (~2.3K; 19.4% of all accounts in the community) which contain the words “XRP” or “Ripple” in their bios. Here’s a sampling of said accounts, taken from the section highlighted above:

Accounts include: @aps_aps_aps_aps, @Think_Rule1804, @mowax4, @sheikhs_milk, @buzzjet1484, @naminami_08, @canbey_cotta, @Mmmi0322Mmmi, @fantheman7671, @purupururippuru

As you can see, in addition to XRP, there are several other coins listed in many of the (fake) account bios from mod class = 2

Enter @emy_wng

Emi Yoshikawa (@emy_wng) leads Ripple’s “global business expansion and strategic corporate partnerships to accelerate blockchain adoption” (per Emi’s LinkedIn profile). More specifically, she manages “joint venture activities and business development for Asia (Japan, China, Korea, ASEAN).”

I don’t know Emi and the first time I encountered her name was when reviewing @GiantGox’s network graph. Emi received her MBA from Harvard, and I am sure she is brilliant. Point being, I am simply presenting data. This is nothing personal.

Here are the accounts from mod class = 0 which share the most connections with accounts connected to @GiantGox (descending, starting with most connections shared):

Where modularity class = 0 and limited to accounts which are followers of @GiantGox. Red text = Ripple employees and core members of the XRP Army (where an actual name can be discerned). Orange rows = accounts where Following > Followers (i.e. lost many followers during Twitter’s recent account purge). @GiantGox falls into this mod class/community (left it out above)

Here are the accounts from mod class = 2 which share the most connections with accounts connected to @GiantGox (descending, starting with most connections shared):

Where modularity class = 2 and limited to accounts which are followers of @GiantGox. Green rows = accounts which contain “XRP” or “Ripple” in their bios

Here is a summary of followers overlap between @emy_wng and @GiantGox (broken out my mod class):

The two accounts share nearly 7K followers, most of which are either mod = 0 (2,511 accounts) or mod = 2 (3,329 accounts). Translating this to @GiantGox’s network graph, it explains why @emy_wng’s node/account appears to straddle those respective communities (mod = 0 and mod = 2):

About a quarter of the accounts (1,747) which @emy_wng and @GiantGox share as followers have “XRP” or “Ripple” in their bios:

Here are some of the least connected accounts from mod class = 2 which follow both @emy_wng and @GiantGox (and include “XRP” or “Ripple” in their bios):

Accounts include: @T6IEdGuiMbVfXhl, @unknown06709621, @aroerina3, @chrochandeees, @abovetenten, @chocokatz, @tsutsun329, @kzpnbkk, @hiro_ixx, @Ripple_increase

Here are some of the least connected accounts from mod class = 0 which follow both @emy_wng and @GiantGox (and include “XRP” or “Ripple” in their bios):

Accounts include: @UPDdf2NzhKTwe7B, @yokohame13, @QcSgJGaYHTAn9FU, @GINJInBO, @SarahAr98811897, @ripple_onlooker, @koko217018ki, @KeithJp2, @dynogeist, @XRP_Ripple578

Here are some of the most active accounts (based on number of tweets/day) from mod class = 2 which follow both @emy_wng and @GiantGox (and include “XRP” or “Ripple” in their bios):

Accounts include: @RippyRemipo3825, @taisakuiinnkai, @kenkenrippler, @gomaajiramen, @fz600kto, @sigure1216, @Riploc_Rocketed, @lovexrp, @itu6UXSDA0O0otv, @jyohotaro

Here are some of the more active accounts (based on number of tweets/day) from mod class = 0 which follow both @emy_wng and @GiantGox:

Accounts include: @dlrufkgk, @KingMalcolmRex, @feelhappy, @Marlin_NotNemo, @kittytm40, @ChuckBaggett, @olehomojyanaiyo, @XRPHODLER, @januaryCOM, @Ricardo88645502

This community (mod class = 2) is comprised primarily of (Japanese language, crypto-focused) fake accounts. It includes crypto-focused fake accounts broadly, rather than being specific to XRP/Ripple (oftentimes TRX, BCH, and NEO, for example, appear in bios/tweets, along with XRP/Ripple)

Modularity Class = 1

There are 4,814 nodes/accounts (4,368 @GiantGox followers) in this mod class/community:

Notable accounts viewable above include: @RealArea, @degisam, @takacello, @gstokyo, @accessLabo, @5ka9com, @N_A_B_E_T_Y, @sima312, @Juana02official (now suspended), @Juana05official (now suspended), @sima312, @heyxt137, @heyxt138, @shinbo417, @nnnn_wor_nnnn, @thegenesis2016, @takutaku0526, @ryotaro_yophida, @baitochat, @nikotama0001, @teen2910, @marinamiries

Here are the accounts from mod class = 1 which share the most connections with accounts connected to @GiantGox (descending, starting with most connections shared):

Where modularity class = 1 and limited to accounts which are followers of @GiantGox. Yellow rows/red text = accounts that were immediately suspended by Twitter after I tweeted this on July 31st, 2018 (there were 8 @JuanaXXofficial accounts following @GiantGox; 6 were mod class = 1 and 2 were mod class = 3; all 8 accounts have been suspended)

This community is comprised primarily of (Japanese language, non-crypto-focused) large fake (follow-for-follow) accounts. Take a look once more (above) at the following/followers counts of the most connected accounts from this modularity class (avg # followers: 12,866, avg # following: 12,368).

Here are some examples of accounts from this community (89.3% have language set to Japanese; 10% English):

Accounts include: @sakamobi, @dakarakoso, @Natural_Paint, @telphoneSex, @bitcoin_sougo, @drunk_freedom, @populus1q3, @bros_inc, @RealArea

While conducting this research, I tweeted about a ridiculously obvious group of fake accounts which I encountered. The majority of these accounts (below) were previously part of this community (mod class = 1) — that is, until Twitter removed the accounts shortly after my tweet:

These accounts were following @GiantGox when data was sourced for network graph (July 21st, 2018); accounts were suspended by Twitter after I tweeted this on July 31st, 2018. With the exception of @Juana07official and @Juana08official (mod class = 3), the remaining 6 accounts were mod class = 1

Modularity Class = 4

There are 3,349 nodes/accounts (3,057 @GiantGox followers) in this mod class/community:

Notable accounts viewable above include: @Ripple, @yoshitaka_kitao, @bitcoinchannnel, @Keiki_XRP, @tenitoshi, @bitbit_ojin, @coperu100, @twins_naoki, @TO30447473, @Exri8Exri, @coinpicksjapan, @crypto_fumiya, @coinjourney, @shakurefubuki, @miyapparappa

Here are the accounts from mod class = 4 which share the most connections with accounts connected to @GiantGox (descending, starting with most connections shared):

Where modularity class = 4 and limited to accounts which are followers of @GiantGox. Green rows = username appears to be crypto-focused. Orange rows = accounts where Following > Followers (i.e. lost many followers during Twitter’s recent account purge). For this mod class/community, @Ripple shares most connections with @GiantGox’s connections (not included above as @Ripple isn’t a follower of @GiantGox)

For this mod class/community, @Ripple shares most connections with @GiantGox’s connections (not included in the tables above as @Ripple isn’t a follower of @GiantGox).

This community is comprised primarily of (Japanese language, crypto-focused) fake accounts. It includes crypto-focused fake accounts broadly, rather than being specific to XRP/Ripple (oftentimes TRX, BCH, and NEO, for example, appear in bios/tweets, along with XRP/Ripple).

Here are some examples of accounts from this community (89.5% have language set to Japanese; 10% English):

Accounts include: @coinpicksjapan, @bitmania999, @6BillionPeople, @coin_post, @bitbit_ojin, @Bitcoin_Invest, @gox_crypt, @tenitoshi, @sizuku_bitcoin, @1000crypto

Worth calling attention to @6BillionPeople, a Japanese-based account which lost more than 2 million followers during Twitter’s recent account purge:

Above screenshot is from August 21st, 2018; data in table is from July 21st, 2018 (hence reflects different Followers/Following counts)

It is the most central account (largest eigenvector centrality) in this mod class/community and may be seen below:

Highlighting @6BillionPeople (orange node, top center)

Still highlighting @6BillionPeople (zoomed out)

Still highlighting @6BillionPeople (zoomed further out; red circle)

Here are a few tweets from @6BillionPeople which mention XRP or where others mention @6BillionPeople and XRP:

I don’t know much about @6BillionPeople — aside from the fact that the account lost 2 million+ followers when Twitter began “removing tens of millions of suspicious accounts from users’ followers” on July 12th, 2018 (during what has been dubbed the Twitter Purge). Similar to as was mentioned earlier re: @emy_wng earlier — I am simply letting the data speak here.

Allegations of market manipulation coupled with the account losing more than 2 million “suspicious” accounts during the Twitter Purge, one would think that Twitter would conduct a thorough audit on the account.

The fact that it appears Twitter has not done so doesn’t surprise me one bit.

In fact, there have been numerous occasions where I have reported networks of fake/bot accounts spreading political propaganda on Twitter, where I was ignored (in some cases for months) by Twitter until the press would cover said networks:

To be fair, the @6BillionPeople account follows 4.7M accounts, hence it shouldn’t come as too much of a surprise that it is so central in relation to the accounts connected to @GiantGox (most of which are fake/bot accounts). It is, however, noteworthy.

At the very least, what is clear is this: Twitter has a long ways to go until their platform is no longer propped up by misleading/inflated follower/following counts

Modularity Class = 3

There are 3,260 nodes/accounts (2,755 @GiantGox followers) in this mod class/community:

Notable accounts viewable above include: @tanjaplayner, @75fM1, @ABOALLAIL2, @ALGOAHRH1, @nalmtery, @O8z__, @RetrieverPlanet, @alywh, @dla3noof, @__sI1, @u_m305, @a4_u8, @kse_2030, @Dorsetghost, @soulskiller94, @77_ss7, @lessonlisa, @n__nony, @Ayed_Honey, @w_z_e, @VIP_G5, @ndr_7rb, @itslovesnotes, @Itsworldpost, @rffoi4, @retj_m, @SA2__0

Here are the accounts from mod class = 3 which share the most connections with accounts connected to @GiantGox (descending, starting with most connections shared):

Where modularity class = 3 and limited to accounts which are followers of @GiantGox. Yellow rows = accounts where lang = Japanese (ja), only 6 from the list above; 60% of list above are accounts where lang = Arabic (ar)

This community is comprised primarily of (non-Japanese language, non-crypto-focused) large fake (follow-for-follow) accounts. Take a look once more (above) at the following/followers counts of the most connected accounts from this modularity class (avg # followers: 144,919, avg # following: 165,629).

Here are some examples of accounts from this community (45.6% have language set to English; 35% Arabic; 9.9% Japanese; 2.5% Turkish; 1.6% Russian; 1.3% Spanish):

Accounts include: @fl__l, @75fM1, @Z0Z80, @toolle_, @08a, @G_alyya, @pandoraskids, @48a__, @Q8____33, @77r__

The accounts in this community have zero interest in XRP/Ripple; they are simply being used to create the illusion that that XRP/Ripple Army is larger than reality. For comparison, only 11 (0.4%) of accounts from mod class = 3 have “XRP” or “Ripple” in their bios (far, far less than other modularity classes/communities connected to @GiantGox).

Conclusion

The purpose of this post is simply to illustrate to Ripple’s CTO, David Schwartz, that there exist many XRP fake/bot accounts:

I do hope that other researchers/academics (dare I suggest even Twitter themselves?) pick up where I left off, as I suspect it’s a good start to mapping out Twitter’s crypto fake/bot account ecosystem (where Twitter users continue to lose millions of dollars as a result of Twitter’s negligence).

As we all know, the user experience re: crypto Twitter (and Twitter more broadly) would be tremendously improved if Twitter more effectively removed fake/bot accounts.

More importantly, democracies across the world continue to be gamed as a result of Twitter’s negligence in removing fake/bot accounts. This needs to change.

If you enjoyed this post, please share some claps (you can share up to 50!)

Geoff Golberg (that’s me!) is an NYC-based marketer who is fascinated by network graph analysis — more specifically, when applied to social networks and blockchain activity (social/blockchain forensics excite me!). Geoff’s experience spans structured finance, ad tech, and digital marketing/customer acquisition, both at startups and public companies

Andy Patel (Helsinki-based) is a researcher at F-Secure, where he specializes in neural network implementations, NLP, and graph analysis. He currently splits his time between conducting research into Twitter bots/disinformation (where Andy has nearly 3 years of experience) and prototyping machine learning models for cyber security purposes

Thanks to Calvin Chu and Pankaj Jain for giving the post a read (and providing feedback!) while I was banging my head on the wall writing it