Jupiter (DEX Aggregator)

Documented and closed events. They stay on file: an operator’s past is data, not a verdict.

1. Feb 5, 2025 Hack / funds theft Moderate ✓ resolved

   Jupiter's official X account was taken over and used to push two fake tokens ($MEOW and $DCOIN): the protocol and user funds were never touched, and the losses of those who bought were never quantified or reimbursed

   On the evening of 5 February 2025 (US time) Jupiter's official X account — the channel through which the project speaks to its audience — was taken over by attackers, who used it to promote a fake token called $MEOW (the name of the project's mascot and pseudonymous co-founder) and then a second one, $DCOIN. The alert came from the project itself, via the Jupiter Mobile account: "The main Jupiter Exchange account has been compromised. Team is working on restoring access", together with a warning not to click any link. The account was recovered within a few hours, overnight between 5 and 6 February. What did NOT happen, and it is the part that matters for anyone using the aggregator: none of Jupiter's contracts were touched and no user or treasury funds were taken — the team stated that assets remained safe in multisig wallets and that the compromise was limited to the X account, with no other channels affected. What did happen to those who believed the post: anyone who bought $MEOW in the minutes when it looked like a project announcement was left holding a token with no liquidity after its creator pulled out. ⚠️ There is no verified figure for the losses: reports speak of "millions lost in minutes" and of the fake token's market cap climbing past $20-30 million before collapsing, but a token's market cap is not a loss, and no source — neither Jupiter nor any third party — has ever published a count of victims or amounts. That is why the amount field is left empty: putting the market cap there would be a false number. No reimbursement was announced, and the JUP token fell about 12% during the episode. The incident is recorded here because the compromised account was the service's own official one: this is not third-party phishing aimed at a brand's users, it is the brand itself speaking with an attacker's voice for a few hours.

   ↗ source

verified on Oct 1, 2026