Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam
Meteora treasury (OTC buyback of MET)
On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel.
Why this severity: $1.5M reported stolen, 1 victims.
- Started
- Jan 17, 2026
- Closed
- Jan 17, 2026
- Chains
- Solana
- Reported stolen
- $1.5M
- Victims
- 1
At risk
- Meteora treasury (OTC buyback of MET)
- Solana wallets
What to do now
- If you are mid-way through an OTC deal, stop and re-confirm the counterparty and escrow address by voice or video, using contact details you already had before the deal.
- Treat any change to payment or escrow details sent in chat as a red flag.
Stay safe
Am I affected?
Meteora users were not affected. The loss came from the team's own treasury. It matters to any project or fund that buys or sells tokens OTC.
What to do now
- If you are mid-way through an OTC deal, stop and re-confirm the counterparty and escrow address by voice or video, using contact details you already had before the deal.
- Treat any change to payment or escrow details sent in chat as a red flag.
How to avoid this
- Only use escrow providers you contact through channels you already trust, never ones introduced inside the deal chat.
- Send a small test, and have the counterparty confirm receipt through a separate channel, before the full amount.
- Require two people from the team to approve treasury transfers to any new address.
Timeline 2
OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.
SourceMeteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.
Source
Alerts & on-chain evidence 1
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.