Investigation attributing high-profile Twitter account takeovers and phishing drainer thefts to Cameron Redman (“Cam”/“Cream”), later sentenced in the U.S.
A wave of high-profile Twitter account takeovers, hijacked accounts pushing phishing links that drained followers' wallets and NFTs, traced back to a single operator working under the handles “Cam” and “Cream.” The investigation connected the takeover infrastructure and drainer proceeds to Cameron Redman, a Canadian teenager at the center of the SIM-swap and account-takeover scene.
The attribution followed the standard seams: proceeds from the drainer wallets flowing into accounts and services tied to Redman's online identities. Publishing the connection put a name on a pattern of thefts that had victimized followers of trusted accounts.
The case ended in court. Redman was charged in the U.S. and sentenced to a year in prison for an NFT theft scheme, one of the earlier cases of a social-media account-takeover crypto thief facing cross-border consequences.
2021–2022
High-profile Twitter accounts are hijacked to push phishing links, draining followers' funds and NFTs.
August 24, 2022
Investigation published attributing the takeovers and drainer proceeds to Cameron Redman (“Cam”/“Cream”).
Later
Redman is charged and sentenced in the U.S. to a year in prison for an NFT theft scheme.
Investigation: attributing a wave of Twitter account takeovers and drainer thefts to Cameron Redman, known as “Cam”/“Cream.”
ZachXBT@zachxbtAugust 2022Update: Cameron Redman was convicted and ordered to pay restitution. The 2022 sale of X panel access led to a string of high-profile account compromises and phishing thefts.
ZachXBT@zachxbtJuly 2025
