Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site
Arbitrum DAO followers on X
On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time.
Why this severity: Only partly contained, a narrower target.
- Started
- Feb 3, 2026
- Closed
- Feb 3, 2026
- Chains
- Arbitrum
Indicators · never visit or send to these
- gov-arbitrum[.]com
What to do now
- Revoke approvals and permits you don't recognise on Arbitrum and Ethereum (revoke.cash or your wallet's approvals page).
- If you signed a message there or typed a seed phrase, move funds to a new wallet.
Stay safe
Am I affected?
Only if you followed the airdrop link from the Arbitrum DAO X account on or around 3 February 2026 and connected a wallet or signed anything on gov-arbitrum[.]com.
What to do now
- Revoke approvals and permits you don't recognise on Arbitrum and Ethereum (revoke.cash or your wallet's approvals page).
- If you signed a message there or typed a seed phrase, move funds to a new wallet.
How to avoid this
- A 'snapshot confirmed, claim now' post with a link is a classic drainer lure, even from a verified account. Check the project's official website and other official channels first.
- Never connect a wallet that holds savings to a claim site; use an empty burner wallet to check eligibility.
Timeline 2
News & write-ups ›1
How this method works
Look-alike pages promise a token airdrop, a reward or a mint. Connecting and signing is the drain. Read about fake airdrop, claim and mint sites →
Follow new drains and updates in your feed reader or Telegram RSS bot.