Jack Kong, founder of Nano Labs, stated that the X account has been reclaimed. The attacker sent a phishing email to his publicly used email, and the AI assistant misidentified the fake link as the official X verification page. He entered the verification code sent to his linked email into the counterfeit page, resulting in the account being transferred.

During the time the account was compromised, it briefly posted false projects and scam content. He warned that even if AI determines a link is trustworthy, one should not click on unofficial addresses, and he has set the linked email for X to a non-public address. Nano Labs is a BNB crypto treasury company listed on the US stock market, where he serves as chairman.

The method did not rely on cracking passwords but on the public email and assistant summaries. The verification code itself was sent by X to the real linked inbox, which the holder handed over to the counterfeit domain. The assistant wrote the phishing page as an official third-party verification, shortening the manual verification of the domain.

Similar incidents have repeatedly occurred in the crypto executive circle: public contact information, assistants reading emails, and verification codes being re-entered. This time, "AI helping to read emails" was noted as one of the conditions for the theft.

After the account was restored, the previous false project posts became invalid, but screenshots and forwards are still circulating. The company has not publicly disclosed the on-chain financial loss figures, and the public narrative remains focused on social media control.

In market mechanisms, what is sold is the trust endorsement of the founder's account, and what is bought is the verification code on the counterfeit page. Attention has shifted from treasury narratives to account theft warnings; the beneficiaries are the phishing parties that can intercept the verification codes, while the pressured parties are those who made their commonly used emails public and allowed assistants to open links. The incident was driven by email and model misjudgment, rather than exchange hot wallets.

Source: Public Information