{
 "tag": "false-top-up",
 "name": "False Top Up",
 "group": "Other",
 "incidents": [
  {
   "slug": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "title": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026",
   "json": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)",
   "tags": [
    "solana",
    "token-owner-swap",
    "spl-token",
    "setauthority",
    "false-top-up",
    "custody",
    "deposit-spoofing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-01",
   "closedAt": "2026-03-31",
   "updatedAt": "2026-03-31T12:00:00Z",
   "summary": "In February 2026 Liminal Custody's monitoring caught two low-value attempts that used SetAuthority to reassign an attacker's temporary SPL token account to a customer's deposit address after a net-zero transfer, so systems that look up owners through RPC could credit a deposit that never happened. Liminal says no erroneous credit occurred and no customer funds were affected. Exchanges, custodians and payment apps on Solana should verify the expected associated token account and real balance increases before crediting."
  }
 ],
 "changes": [
  {
   "incident": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-31",
   "title": "Liminal publishes a write-up of the 'false top-up' technique and says it deployed instruction-level filtering and ATA validation.",
   "sourceUrl": "https://www.liminalcustody.com/?p=21280",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026"
  },
  {
   "incident": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-01",
   "title": "During February, Liminal Custody's SOC detects and neutralises two low-value SPL token-account ownership reassignment attempts (exact days not published).",
   "sourceUrl": "https://www.liminalcustody.com/?p=21280",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026"
  }
 ]
}