{
 "slug": "meteora-fake-otc-escrow-1-5m-jan-2026",
 "title": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
 "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026",
 "json": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "solana"
 ],
 "method": "social-engineering",
 "product": "Meteora treasury (OTC buyback of MET)",
 "tags": [
  "solana",
  "social-engineering",
  "otc",
  "escrow",
  "impersonation",
  "treasury",
  "meteora",
  "usdc"
 ],
 "amountUsd": 1500000,
 "victims": 1,
 "startedAt": "2026-01-17",
 "closedAt": "2026-01-17",
 "updatedAt": "2026-04-30T12:00:00Z",
 "summary": "On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel.",
 "timeline": [
  {
   "date": "2026-01-17",
   "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana"
  },
  {
   "date": "2026-04-30",
   "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.",
   "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "SlowMist Hacked: Solana incidents (Meteora)",
   "url": "https://hacked.slowmist.io/?c=Solana",
   "publisher": "SlowMist",
   "date": "2026-01-17"
  },
  {
   "kind": "news",
   "title": "Meteora Loses $1.5M USDC in Fake OTC Escrow Scam",
   "url": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss",
   "publisher": "OurCryptoTalk",
   "date": "2026-04-30"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nMeteora users were not affected. The loss came from the team's own treasury. It matters to any project or fund that buys or sells tokens OTC.\n\n## What to do now\n- If you are mid-way through an OTC deal, stop and re-confirm the counterparty and escrow address by voice or video, using contact details you already had before the deal.\n- Treat any change to payment or escrow details sent in chat as a red flag.\n\n## How to avoid this\n- Only use escrow providers you contact through channels you already trust, never ones introduced inside the deal chat.\n- Send a small test, and have the counterparty confirm receipt through a separate channel, before the full amount.\n- Require two people from the team to approve treasury transfers to any new address.",
 "notes": null,
 "agentBrief": "# Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Solana · Method: Social engineering and fake support\n- Started: Jan 17, 2026 · Last update: Apr 30, 2026 · Reported stolen: $1.5M · Victims: 1\n- Who/what: Meteora treasury (OTC buyback of MET)\n\nOn Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel.\n\n## Am I affected?\nMeteora users were not affected. The loss came from the team's own treasury. It matters to any project or fund that buys or sells tokens OTC.\n\n## What to do now\n- If you are mid-way through an OTC deal, stop and re-confirm the counterparty and escrow address by voice or video, using contact details you already had before the deal.\n- Treat any change to payment or escrow details sent in chat as a red flag.\n\n## How to avoid this\n- Only use escrow providers you contact through channels you already trust, never ones introduced inside the deal chat.\n- Send a small test, and have the counterparty confirm receipt through a separate channel, before the full amount.\n- Require two people from the team to approve treasury transfers to any new address.\n\n## Sources\n- SlowMist Hacked: Solana incidents (Meteora) (SlowMist, 2026-01-17): https://hacked.slowmist.io/?c=Solana\n- Meteora Loses $1.5M USDC in Fake OTC Escrow Scam (OurCryptoTalk, 2026-04-30): https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss\n\nFull record: https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026 · JSON: https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}