Cyber Incident Victim: Ghana Football Association
Date:
Mar 2025
Location:
Ghana
Summary
The verified X account of Ghana's President John Mahama was compromised and used for approximately 48 hours to promote a fraudulent cryptocurrency scheme named Solanafrica. Hackers posted messages falsely claiming Mahama led the project, soliciting investments under the guise of enabling free payments in Africa via the Solana blockchain. While the team removed the initial fraudulent posts, crypto-related content continued briefly. This incident highlights concerns about rising crypto fraud in Africa exploiting verified accounts. Similar compromises targeted South Africa's opposition leader and a Nigerian businessman previously. Authorities regained control of the account and urged the public to disregard suspicious crypto messages from it.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The verified X account of Ghanaian President John Mahama was compromised over a weekend, beginning on Saturday and lasting for approximately 48 hours. During this breach, unauthorized individuals gained control of the account and used it to promote a fraudulent cryptocurrency initiative named Solanafrica. The hackers posted messages falsely claiming President Mahama was leading the Solanafrica project, which purportedly aimed to enable free payments across Africa using the Solana blockchain. These posts actively encouraged the president's followers to invest in the scheme, presenting it as a revolutionary financial transaction initiative for the continent. The compromise was detected on Sunday when the account began disseminating these specific fraudulent promotional messages.
President Mahama's team identified the unauthorized activity and took action to remove the Solanafrica promotion posts. However, even after the initial fraudulent messages were deleted, the compromised account continued to share cryptocurrency-related content, including hints about the launch of a new memecoin. The president's spokesperson, Kwakye Ofosu, publicly confirmed the account compromise on Tuesday, stating that necessary steps had been taken to regain control. Ofosu announced that the account was fully restored by Tuesday and explicitly advised the public to disregard any further suspicious cryptocurrency-related messages originating from the president's account. The incident highlighted ongoing concerns about the rise of cryptocurrency fraud in Africa, where digital assets are popular but regulatory frameworks are often underdeveloped, and where verified accounts of prominent figures are frequently targeted to promote fake investment schemes. President Mahama subsequently used the restored account to thank his team and the X support team for their assistance in recovering the account.