{
 "tag": "fake-airdrop-site",
 "name": "Fake airdrop, claim and mint sites",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "fake-cjup-jupiter-airdrop-drainer-may-2026",
   "title": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites",
   "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026",
   "json": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "fake-airdrop-site",
   "product": "Jupiter (JUP) community and Solana wallet users",
   "tags": [
    "solana",
    "fake-airdrop-site",
    "jupiter",
    "jup",
    "jupuary",
    "airdrop",
    "spam-token",
    "impersonation",
    "solana-floor"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-22",
   "closedAt": "2026-05-22",
   "updatedAt": "2026-05-22T12:00:00Z",
   "summary": "In May 2026, Solana Floor warned that scammers were sending counterfeit '$CJUP' tokens to Solana wallets while impersonating Jupiter's Jupuary airdrop. The tokens point holders to phishing 'claim' sites that drain any wallet that connects. Losses were not quantified. Jupiter had not announced a new airdrop at the time, and its only official site is jup[.]ag. If a token you never bought appears with a claim link, ignore it."
  },
  {
   "slug": "arbitrum-dao-x-account-hijack-feb-2026",
   "title": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026",
   "json": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "arbitrum"
   ],
   "method": "fake-airdrop-site",
   "product": "Arbitrum DAO followers on X",
   "tags": [
    "arbitrum",
    "fake-airdrop-site",
    "x-account-hack",
    "fake-airdrop",
    "social-media",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-03",
   "closedAt": "2026-02-03",
   "updatedAt": "2026-02-03T12:00:00Z",
   "summary": "On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time."
  },
  {
   "slug": "dmt-airdrop-dexmaxai-phishing-nov-2025",
   "title": "DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana",
   "url": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025",
   "json": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "fake-airdrop-site",
   "product": "DMT airdrop claimants (@dexmaxai)",
   "tags": [
    "solana",
    "fake-airdrop-site",
    "airdrop",
    "dmt",
    "dexmaxai",
    "x-account",
    "claim-phishing"
   ],
   "amountUsd": 130000,
   "victims": null,
   "startedAt": "2025-11-20",
   "closedAt": "2025-11-20",
   "updatedAt": "2025-11-20T12:00:00Z",
   "summary": "SlowMist's hack database lists a $130,000 phishing loss on Nov 20, 2025, filed under Solana, tied to the DMT token airdrop promoted by the X account @dexmaxai. The airdrop claim was the lure for the phishing. If you claimed DMT, check your wallet for token delegations or unexpected outgoing transfers and move what is left to a new wallet."
  },
  {
   "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
   "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "fake-airdrop-site",
   "product": "Aave and other DeFi users receiving fake reward emails",
   "tags": [
    "multi-evm",
    "fake-airdrop-site",
    "aave",
    "lovable",
    "ai-website-builder",
    "email-phishing",
    "sendgrid",
    "wallet-connect",
    "proofpoint",
    "drainer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-06-17",
   "closedAt": "2025-08-20",
   "updatedAt": "2025-08-20T12:00:00Z",
   "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published."
  }
 ],
 "changes": [
  {
   "incident": "fake-cjup-jupiter-airdrop-drainer-may-2026",
   "incidentTitle": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-22",
   "title": "COINTURK reported Solana Floor's warning about fake $CJUP tokens impersonating Jupiter's Jupuary and linking to wallet drainers.",
   "sourceUrl": "https://en.coin-turk.com/fake-cjup-airdrop-drains-solana-wallets-within-minutes/",
   "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "dmt-airdrop-dexmaxai-phishing-nov-2025",
   "incidentTitle": "DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-20",
   "title": "SlowMist's hack database recorded a $130,000 phishing loss tied to the DMT airdrop promoted by @dexmaxai.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana",
   "url": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  }
 ]
}