- Posts revealed passports, phone numbers, emails, and a contact named “Arvind”.
- ZachXBT says attackers used social engineering to gather Gokal’s information.
- Meta removed the posts 90 minutes after the account was compromised.
In a serious cybersecurity breach, Solana co-founder Raj Gokal’s personal data has been leaked following the compromise of rapper Migos’ official Instagram account.
The hack, which took place on May 25, 2025, included multiple images of Gokal and his wife’s identification documents, including passports and driver’s licences.
The attackers reportedly demanded a ransom of 40 Bitcoin and began releasing the content after their demands were unmet.
The incident has sparked widespread concern over data security, social engineering, and the potential scale of personal data exposure linked to broader industry breaches.
Hackers posted KYC images and contact info
The compromised Instagram account posted at least seven photos containing Gokal’s personal details, including one in which he held up a passport. Another included a caption that read, “It was only 40 BTC.. should’ve paid.”
Several posts displayed phone numbers and email addresses, while one image showed a man identified only as “Arvind,” raising further concerns about the extent of the data theft.
The posts remained visible for around 90 minutes before Meta took action to remove them and regain control of the account.
During that window, a Telegram link was also shared in Migos’ altered bio, promoting a meme coin and allegedly unreleased music tracks.
Suspected tactics and previous warnings
Blockchain investigator ZachXBT suggested that the attackers used social engineering tactics over the past week to target Gokal.
He noted that the hackers attempted to extort funds using personally identifiable information (PII) acquired before launching their online assault.
“They tried to extort him for funds with the PII obtained,” ZachXBT stated on X, formerly Twitter. “Guess he didn’t pay so they started trolling and posted it after they compromised Migos Instagram account today.”
Gokal had already alerted his followers days before the incident.
In a post on X, he warned that unknown attackers had been trying to access his email, Apple ID, Google account, and other digital assets.
He cautioned users to avoid engaging with suspicious links or fund solicitations appearing in his name.
Questions raised over Coinbase link and data origin
The nature of the leaked images has led some analysts to believe that they could be Know Your Customer (KYC) verification files, typically used for identity confirmation by crypto platforms.
This assumption has fuelled speculation that Gokal’s data might be linked to the recent Coinbase data breach.
Earlier in May, Coinbase disclosed that a security incident had affected roughly 1% of its monthly active users. The hackers reportedly demanded a $20 million ransom from the exchange.
Although no payment was made, fears have grown that the attackers may have accessed user KYC documents, including photographs used in self-verification.
“If they have the KYC for the founders of Solana, then they have the KYC for every single person that ever used their platform,” one analyst wrote.
This is like 10 times worse than a regular KYC leak.
Despite the speculation, there is no verified evidence currently linking Gokal’s data leak directly to the Coinbase breach.
Both Meta and Gokal have yet to release official statements on the incident, and the exact source of the compromised information remains unconfirmed.
Meta faces pressure amid rising crypto-related account breaches
The incident adds to a growing list of high-profile social media breaches involving crypto scams.
Bad actors have increasingly hijacked verified accounts of celebrities and influencers to shill fraudulent tokens, often leaving victims with unrecoverable losses.
In this case, however, the attackers appear to have combined extortion with public humiliation and promotion, underlining the evolving tactics used in crypto-targeted cyberattacks.
The use of a popular public figure’s compromised Instagram account to leak sensitive data raises urgent questions for platforms like Meta on how they are addressing these breaches.
As of now, the full extent of the information leak, including whether other Solana team members were affected, remains unknown.
Users across the crypto community are being urged to stay alert, monitor their digital accounts closely, and practise enhanced cybersecurity hygiene in light of these developments.
