{
 "tag": "impersonation",
 "name": "Impersonation",
 "group": "Other",
 "incidents": [
  {
   "slug": "fake-cjup-jupiter-airdrop-drainer-may-2026",
   "title": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites",
   "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026",
   "json": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "fake-airdrop-site",
   "product": "Jupiter (JUP) community and Solana wallet users",
   "tags": [
    "solana",
    "fake-airdrop-site",
    "jupiter",
    "jup",
    "jupuary",
    "airdrop",
    "spam-token",
    "impersonation",
    "solana-floor"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-22",
   "closedAt": "2026-05-22",
   "updatedAt": "2026-05-22T12:00:00Z",
   "summary": "In May 2026, Solana Floor warned that scammers were sending counterfeit '$CJUP' tokens to Solana wallets while impersonating Jupiter's Jupuary airdrop. The tokens point holders to phishing 'claim' sites that drain any wallet that connects. Losses were not quantified. Jupiter had not announced a new airdrop at the time, and its only official site is jup[.]ag. If a token you never bought appears with a claim link, ignore it."
  },
  {
   "slug": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "title": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026",
   "json": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "social-engineering",
   "product": "Meteora treasury (OTC buyback of MET)",
   "tags": [
    "solana",
    "social-engineering",
    "otc",
    "escrow",
    "impersonation",
    "treasury",
    "meteora",
    "usdc"
   ],
   "amountUsd": 1500000,
   "victims": 1,
   "startedAt": "2026-01-17",
   "closedAt": "2026-01-17",
   "updatedAt": "2026-04-30T12:00:00Z",
   "summary": "On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel."
  }
 ],
 "changes": [
  {
   "incident": "fake-cjup-jupiter-airdrop-drainer-may-2026",
   "incidentTitle": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-22",
   "title": "COINTURK reported Solana Floor's warning about fake $CJUP tokens impersonating Jupiter's Jupuary and linking to wallet drainers.",
   "sourceUrl": "https://en.coin-turk.com/fake-cjup-airdrop-drains-solana-wallets-within-minutes/",
   "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-30",
   "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.",
   "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-17",
   "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  }
 ]
}