Explainer: How President Mahama’s X account was hacked and used to promote a cryptocurrency platform 

When at 18:59 PM on Saturday, March 15, 2025, a post was published on the official X account of Ghana’s president, John Dramani Mahama, followers engaged the post celebrating particularly the part that suggested that Mahama was supporting a cryptocurrency platform.

This post was authored at a time the president’s use of the account was relatively muted with his last post before March 15 being from the March 6 Independence Day event at the forecourt of the presidency in Accra.

Between March 15 to 17, 2025, GhanaFact observed that the official account of the president had been compromised by hackers.

With more than 2.4 million followers, the compromised account was used to promote a cryptocurrency platform, while managers of the President’s social media account and government communications machinery remained quiet over the incident well over 48 hours after the initial post was published – Saturday, March 15, 2025.

The post was a video with the caption: “Financial inclusion isn’t just a need for Ghana—it’s essential for all of Africa. With its low transaction costs, #Solana could be the key to driving fintech growth and enabling cryptocurrency payments & investments across the continent. Stay tuned for more details soon.”

The video clip that came with the post was of President Mahama speaking at the Africa Prosperity Dialogue (APD) event that took place on February 1, 2025.

President Mahama is heard saying: “The Fourth Industrial Revolution presents Africa with a golden opportunity to leapfrog traditional development models. Digital transformation can drive financial inclusion, improve public service delivery, and create new economic opportunities.

“We must: Expand internet access and digital infrastructure to bridge the digital divide. Encourage fintech and e-commerce to facilitate trade and economic participation. Invest in research and development (R&D) to support homegrown innovations. Technology can make Africa more competitive—if we embrace it strategically.”

The interaction statistics garnered by the post at the time our team archived it were as follows:

Fig 1- Post by the hackers to suggest the president’s endorsement

Fake crypto post circulates online

Aside from the March 15 post, some screenshots online suggested that an earlier crypto-related post was published but was no longer available on the President’s timeline. GhanaFact checks, however, suggest no such post was made.

The text of the supposed initial post read: “Ghana is leading the way for Africa’s fintech sector by making payments fast and free across the continent, with support from Solana and the Bank of Ghana through the Solanafrica project. We look forward to other African nations joining us soon. Support Solanafrica by purchasing memecoin, which helps cover transaction fees.”

Fig 2 – The alleged post that was deleted

It is evident that while the supposed deleted post was an explicit advertisement, the March 15 post uses a video of an event Mahama attended with a misleading caption. 

Another crypto post published

At 6:24 PM on January 17, a little over 48 hours after the first post, another post promoting the Solana Crypto Fund was published on the same X handle.

The post was a quote of the initial post with a caption: “Exciting announcement coming today: Solana will be the backbone of Africa’s fintech and payment systems – FREE, transparent, and lightning fast. Introducing the Solana Crypto Fund-yes, an official African #memecoin too.”

 Fig 3 – Screenshot of the last post by the hackers

Analysis of News reports 

GhanaFact observed that some local news outlets sourced the post for articles, including the state-owned newspaper, Daily Graphic Newspaper, privately run Asaase Radio, and Channel 1 News. These media outlets published the stories with headlines such as “President Mahama champions Solana cryptocurrency as the future of Africa’s digital economy” and “President Mahama touts Solana cryptocurrency as the key to Africa’s fintech growth.”

Aside from local media, some international news platforms and crypto platforms also published articles on the development, amplifying the narrative that the Solana cryptocurrency had received the support of President John Dramani Mahama. 

Cryptocurrency exchange platforms such as Binance, Fintech Magazine Africa, Naira Metrics, and Tech Labari were among platforms that published articles in that direction.

In the case of the Daily Graphic, GhanaFact realised that their X page appeared to have been hacked (as of midday of March 17, 2025). The account was amplifying crypto information by reposting pro-crypto content dating as far back as December 2024. It is not clear whether or not the hack is related to the situation with the President’s X account.

However, the Graphic Communications Group Limited, managers of the Daily Graphic newspaper, are yet to issue any statement to address the attack on its X account. 

Fig 4: Screenshot of the current state of Daily Graphic’s X account 

Umasking SolanAfrica and what do they do?

In all of this, it appears that the biggest beneficiaries of this hack are the people behind the SolanAfrica idea. GhanaFact investigation shows that Solanafrica.com shares colour similarities with Solona, a global crypto trading platform. On their website, they described President John Mahama as the leader of their operations in Ghana. 

“Solanafrica is a project led by Ghana’s president John Mahama to make payments across Africa free using the Solana blockchain. The project includes the launch of a new memecoin called Solanafrica, helping to boost digital payments and financial access in the region.”

According to the platform, payment of transactions which is free when using the platform will be facilitated by the Bank of Ghana, projecting percentages that are allocated to some key players.

On the platform, GhanaFact found the platform has launched a new coin known as the memecoin as part of their project.

Fig 5 – Key details about SoalanAfrica from their website

Alleged Team of SolanAfrica

GhanaFact found the image of the President of Ghana, who was identified by his name, and the picture of the former Bank of Governor, Dr Ernest Addison who was wrongly identified as Dean Adansi Chief, Ceo of Bank of Ghana. 

Another personality added to the team is the deceased Member of Parliament for the Ejisu constituency and deputy finance minister, John Kumah. 

Fig 6 – Images of the supposed Ghana team leading the agency 

It is important to note that, President Mahama on January 31, 2025, replaced Dr Ernest Addison with Dr Johnson Asiama as the governor of the Bank of Governor. The Bank of Ghana does not have a Chief Executive Officer (CEO) as claimed by SolanAfrica, rather the apex bank is led by a governor. 

Also, John Kumah was a deputy finance minister and an MP before his death on March 7, 2024, has been listed as part of their team in Ghana.

Using WHOIS Information to identify the operators of the website

Investigation shows the name of the registrar of Solanafrica.com is protected by WhoisSecure, however, GhanaFact found some details.

Using WHOIS information on the domain name – solanafrica.com, GhanaFact found the website was created a day after the first attack on President Mahama’s X page. 

Whois revealed that the website was created on March 16, 2025, updated on the same date and scheduled to expire on March 16, 2026. 

This means that as of the date the first post was shared with solanafrica.com, the website has yet to be created, or purchased. 

Fig 7 – Screenshot of the registration page of the Solanafrica

Also, information from Whois shows that the platform was registered in Los Angeles, California with an address line of 18 San Carlos Street. 

Fig 8 – Screenshot of WHOIS Information about their website

Government admits to the hacking incident 

More than 48 hours after the incident, on March 17, 2025, the President’s spokesman, Felix Kwakye Ofosu publicly addressed the rising concerns of citizens online, admitting for the first time that the president’s account had been compromised with efforts underway to retrieve it.

Subsequently, in the early hours of  March 18, 2025, the Cyber Security Authority of Ghana (CSA) also released a statement on the issue. 

“We understand the public concern this incident has generated and are actively addressing the situation. The authority is working closely with X and other relevant stakeholders to address this incident and to prevent future occurrences,” the statement said.

Fig 9 – CSA statement confirming the account had been hacked

“My team has restored my account, working with the X support team. Thank you for enquiries and offers to assist,” the president posted on his account at 10:30 am, barely an hour after the CSA’s statement. 

Fig 10 – Mahama confirms his account has been restored.

Conclusions

President John Dramani Mahama’s X account is one of the many accounts that have been compromised or hacked by bad actors to spread false endorsements, especially for cryptocurrency marketing. 

Therefore, the public is cautioned to be extra vigilant about suspicious promotion from credible accounts, activate a two-step verification process or install an authenticator app for an extra-layer of security.

Researched by GhanaFact Newsroom