{
 "tag": "usdc",
 "name": "USDC",
 "group": "Other",
 "incidents": [
  {
   "slug": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "title": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026",
   "json": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "social-engineering",
   "product": "Meteora treasury (OTC buyback of MET)",
   "tags": [
    "solana",
    "social-engineering",
    "otc",
    "escrow",
    "impersonation",
    "treasury",
    "meteora",
    "usdc"
   ],
   "amountUsd": 1500000,
   "victims": 1,
   "startedAt": "2026-01-17",
   "closedAt": "2026-01-17",
   "updatedAt": "2026-04-30T12:00:00Z",
   "summary": "On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel."
  },
  {
   "slug": "permit-phishing-440k-usdc-dec-2025",
   "title": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025",
   "json": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum USDC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "erc-2612",
    "usdc",
    "scam-sniffer",
    "signature-phishing"
   ],
   "amountUsd": 440358,
   "victims": 1,
   "startedAt": "2025-12-08",
   "closedAt": "2025-12-08",
   "updatedAt": "2025-12-09T12:00:00Z",
   "summary": "An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions."
  },
  {
   "slug": "solana-address-poisoning-wave-2025-2026",
   "title": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026",
   "json": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "address-poisoning",
   "product": "Solana wallet users sending to exchange deposit addresses",
   "tags": [
    "solana",
    "address-poisoning",
    "dusting",
    "usdt",
    "usdc",
    "phantom",
    "exchange-deposit",
    "bitquery"
   ],
   "amountUsd": 940106,
   "victims": 1104,
   "startedAt": "2025-11-17",
   "closedAt": null,
   "updatedAt": "2026-10-12T12:00:00Z",
   "summary": "Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history."
  }
 ],
 "changes": [
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-12",
   "title": "CryptoSlate reported that 1,104 wallets in a studied subset paid $940,106 to poisoned addresses, described as a minimum.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Bitquery published findings that 4,497,798 Solana wallets were targeted with lookalike addresses over about 11 months.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-30",
   "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.",
   "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-17",
   "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-09",
   "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.",
   "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-08",
   "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.",
   "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-11-17",
   "title": "A Solana wallet sent a $10 USDT test to its Gate.io deposit address; 12 seconds later a lookalike sent dust, and the wallet then sent 30,749.80 USDT to the lookalike.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  }
 ]
}