ICANN’s X (Twitter) account hacked to promote crypto scheme – Domain Name Wire

Domain Name Wire | Domain Name News
Domain Name Industry News
Andrew Allemann 3 Comments February 12, 2025
I hope no one purchased $DNS. You can be excused for doing a double take yesterday if you follow The Internet Corporation for Assigned Names and Numbers (ICANN) on X.
The company’s account was briefly compromised last night to promote a crypto scam.
As captured by John Berryhill, the perpetrators posted information suggesting that ICANN was behind a new crypto project. One post read:
@icann is redefining digital ownership with $DNS – The first memecoin to merge domain governance and Web3 culture on @solana.
ICYMI
[image or embed]
— John Berryhill (@berryhillj.bsky.social) February 11, 2025 at 6:22 PM

The post promised an X Spaces event to discuss it.
The post linked to a .org domain that was subsequently deleted. The domain has been re-registered but does not resolve.
It appears that ICANN was quickly able to recover the account.
ICANN has not yet posted anything on X explaining what happened and did not immediately respond to a request for comment from Domain Name Wire.
No related posts.
Categories: Policy & Law
Andrew Allemann has been registering domains for over 25 years and publishing Domain Name Wire since 2005. He has been quoted about his expertise in domain names by The Wall Street Journal, New York Times, and NPR. Connect with Andrew: LinkedIn – Twitter/X – Facebook
Stay up-to-date with the latest analysis and news about the domain name industry by joining our mailing list.
No spam, unsubscribe anytime.
John Berryhill says
February 12, 2025 at 1:06 pm
Being hacked happens.
But ICANN simply deleted the Xits and did not issue ANY followup note to the effect that the previously-posted Xits were not genuine. Apparently, one is supposed to simply infer they were unauthorized, leaving everyone to guess.
This is a problem when the reflexively-defensive corporate ego cannot own up to having had a vulnerability, and thus fails to act to appropriately address the event.
Andrew Allemann says
February 12, 2025 at 1:38 pm
My guess is they *do* own up to it, but only after a thorough investigation. Which is not what the overly-cautious organization should do. It should post that it happened (exactly as you said) and say it is investigating it, and then issue a post mortem later.
John Berryhill says
February 12, 2025 at 1:47 pm
People were being “sold” something on what appeared to be a recommendation from ICANN. Those coins are still out there for sale.
The responsible thing would be to immediately state it was unauthorized and that an investigation is ongoing.
But ICANN’s legal advisor paralysis results in irresponsible inaction. Because they are more concerned about hypothetical liabilities for admitting that something unfortunate happened than by actually mitigating the potential harm.
It is shameful, but typical, of the cowardly mentality that prevails in over-lawyered organizations.
Domain Name Wire is a trade publication for the domain name industry covering topics relevant to domain investors, brand owners, policy makers, domain registrars and registries, and more. Founded in 2005, Domain Name Wire has been cited by Wall Street Journal, New York Times, NPR, and Washington Post. Read More About DNW
Stay up-to-date with the latest analysis and news about the domain name industry by joining our mailing list.
No spam, unsubscribe anytime.
© 2005–2025 Domain Name Wire · DNW and Domain Name Wire are trademarks of Brainstorm Labs, LLC