The NBA’s official Instagram account briefly posted a promotion for a memecoin Wednesday night, complete with a contract address for a token created on Pump.fun.
“Where basketball passion meets blockchain innovation. Join the community and explore $NBA today. BUY NOW!” the post read.
The token had been created that same day and had a market cap of roughly $3,500 that evening. The post was deleted quickly and did not reach many buyers.
Thirty-Five Hundred Dollars
That number is the entire story. Somebody breached the social media account of a league with billions in annual revenue and a global audience, and the payoff was a token worth less than a decent courtside seat.
This is what most crypto account takeovers actually look like. The fantasy is a pump that nets millions. The reality is a few hundred dollars of liquidity and a post that gets deleted before most followers scroll past it.
The NBA did not immediately respond to a request for comment about the apparent hack, per Front Office Sports, and there has been no league statement as of this writing.
This Already Happened
In March 2025, hackers posted from an NBA account on X promoting a Solana-based “$NBA Coin.” The league confirmed that hack. The post announced an official digital asset on Solana, linked a different token contract, and was deleted about five minutes later.
Official NBA accounts in Spain, the United Kingdom and elsewhere posted the same announcement in that incident. NASCAR’s official X account was hacked in the same March 2025 wave.
So this is the second time in 19 months. Different platform, same playbook, same outcome.
The Part the League Should Actually Fix
The financial damage here is negligible and the embarrassment is temporary. The real exposure is the one nobody has had to pay for yet.
The NBA’s Instagram reaches an audience that skews young and includes a large number of people who would believe the league was launching a token, because leagues have launched stranger things. The gap between $3,500 and a costly scam is not sophistication. It is how much liquidity the attacker bothered to seed before posting.
A league that is currently running a responsible-gaming campaign warning fans about putting money on sports outcomes has an obvious interest in not having its own account tell those same fans to buy a coin.
Two Strikes
After the 2025 incident the reasonable assumption was that the NBA tightened access across its accounts. Nineteen months later a different platform went down the same way.
Account security at this scale is a vendor-and-permissions problem, not a password problem. Large organizations hand posting access to agencies, scheduling tools and regional partners, and every one of those is a door.
The NBA has not said how this happened, how many accounts were exposed, or whether anyone lost money. Until it does, the honest summary is that the league got hacked twice in under two years and the only thing that saved it both times was that the scammers were not very good at it.
A longtime sports reporter, Carlos Garcia has written about some of the biggest and most notable athletic events of the last 5 years. He has been credentialed to cover MLS, NBA and MLB games all over the United States. His work has been published on Fox Sports, Bleacher Report, AOL and the Washington Post.