{
 "slug": "arbitrum-dao-x-account-hijack-feb-2026",
 "title": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
 "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026",
 "json": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "arbitrum"
 ],
 "method": "fake-airdrop-site",
 "product": "Arbitrum DAO followers on X",
 "tags": [
  "arbitrum",
  "fake-airdrop-site",
  "x-account-hack",
  "fake-airdrop",
  "social-media",
  "phishing"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-02-03",
 "closedAt": "2026-02-03",
 "updatedAt": "2026-02-03T12:00:00Z",
 "summary": "On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time.",
 "timeline": [
  {
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/"
  },
  {
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "The Arbitrum DAO account has been hacked",
   "url": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "publisher": "Cryptopolitan",
   "date": "2026-02-03"
  }
 ],
 "indicators": {
  "domains": [
   "gov-arbitrum[.]com"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly if you followed the airdrop link from the Arbitrum DAO X account on or around 3 February 2026 and connected a wallet or signed anything on gov-arbitrum[.]com.\n\n## What to do now\n- Revoke approvals and permits you don't recognise on Arbitrum and Ethereum (revoke.cash or your wallet's approvals page).\n- If you signed a message there or typed a seed phrase, move funds to a new wallet.\n\n## How to avoid this\n- A 'snapshot confirmed, claim now' post with a link is a classic drainer lure, even from a verified account. Check the project's official website and other official channels first.\n- Never connect a wallet that holds savings to a claim site; use an empty burner wallet to check eligibility.",
 "notes": null,
 "agentBrief": "# Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site\n\n- Severity: Medium · Status: Partly contained (past)\n- Chains: Arbitrum · Method: Fake airdrop, claim and mint sites\n- Started: Feb 3, 2026 · Last update: Feb 3, 2026\n- Who/what: Arbitrum DAO followers on X\n\nOn 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time.\n\n## Am I affected?\nOnly if you followed the airdrop link from the Arbitrum DAO X account on or around 3 February 2026 and connected a wallet or signed anything on gov-arbitrum[.]com.\n\n## What to do now\n- Revoke approvals and permits you don't recognise on Arbitrum and Ethereum (revoke.cash or your wallet's approvals page).\n- If you signed a message there or typed a seed phrase, move funds to a new wallet.\n\n## How to avoid this\n- A 'snapshot confirmed, claim now' post with a link is a classic drainer lure, even from a verified account. Check the project's official website and other official channels first.\n- Never connect a wallet that holds savings to a claim site; use an empty burner wallet to check eligibility.\n\n## Indicators (block these, never visit them)\n- Domain: gov-arbitrum[.]com\n\n## Sources\n- The Arbitrum DAO account has been hacked (Cryptopolitan, 2026-02-03): https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/\n\nFull record: https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026 · JSON: https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}