{
 "tag": "social-media",
 "name": "Social Media",
 "group": "Other",
 "incidents": [
  {
   "slug": "arbitrum-dao-x-account-hijack-feb-2026",
   "title": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026",
   "json": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "arbitrum"
   ],
   "method": "fake-airdrop-site",
   "product": "Arbitrum DAO followers on X",
   "tags": [
    "arbitrum",
    "fake-airdrop-site",
    "x-account-hack",
    "fake-airdrop",
    "social-media",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-03",
   "closedAt": "2026-02-03",
   "updatedAt": "2026-02-03T12:00:00Z",
   "summary": "On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time."
  }
 ],
 "changes": [
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  }
 ]
}