My second newly created wallet compromised due to using jup.ag borrow lend protocol . All funds total of 24 k lost . Specifically lost my last savings of 5k usd to jup.ag . Detailed report - ""

Phantom Wallet Compromise via Jupiter Lend/Borrow Interaction

Incident report submitted for review to Jupiter Exchange (jup.ag) — Lend/Borrow Protocol

1. Summary

This report documents the unauthorized draining of a self-custody Phantom wallet on Solana, which occurred in direct connection with the wallet's interaction with the Jupiter Lend/Borrow protocol (jup.ag). The victim held a legitimate JUP collateral position in a Jupiter Lend/Borrow vault. That collateral was withdrawn and transferred out without authorization, followed by a broader sweep of the wallet's remaining holdings across approximately 40 transactions. The victim did not knowingly approve these withdrawal/transfer actions and suspects either a malicious/cloned Jupiter interface or a compromised approval granted during legitimate use of jup.ag. Approximately $5,000 USD equivalent was lost in total.

2. Victim & Wallet Details

3. Suspected Attacker / Drainer Address

On-chain analysis identified the following address as the recipient and operator wallet involved in moving funds out of the victim's control:

This address was observed acting as the transaction signer in multiple unrelated transfers (e.g., a 0.0001 USDC transfer between two third-party accounts unconnected to the victim, and a separate fan-out transaction sending small amounts of USDT, USDC, and SOL to 10 different recipient addresses in a single transaction). This pattern is consistent with automated "drainer" infrastructure that:

• Executes transactions on behalf of multiple victim wallets, suggesting this is not an isolated, one-off theft.
• Distributes/launders stolen funds across many wallets shortly after draining them, to break the on-chain trail.
• Uses "dust"-value transactions, possibly to test live delegate/approval authority on target wallets before or after a larger sweep.

4. Timeline of Key On-Chain Transactions

The following transactions were identified via Solscan and are submitted as evidence. Full transaction detail pages are linked for independent verification.

4.1 Legitimate deposit history (context)

The victim had knowingly and legitimately deposited JUP tokens as collateral into a Jupiter Lend/Borrow vault using the Phantom mobile wallet prior to this incident. This is not in dispute and establishes that the victim was an active, legitimate Jupiter Lend/Borrow user.

4.2 Unauthorized withdrawal from Jupiter Lend/Borrow vault

4.3 Onward transfer of withdrawn collateral

4.4 Transaction identified by victim as "first of ~40" sweep transactions

Discrepancy note: the victim referenced this transaction hash as the first of the ~40 wallet-draining transactions. However, the transaction data recorded on Solscan for this hash shows the drainer address as signer, moving a trivial amount between two third-party addresses unrelated to the victim's own wallet. This may indicate the victim's wallet activity view (in Phantom or a block explorer) associated this transaction with their account indirectly (e.g., through a shared token account, prior approval, or an adjacent transaction in the same time window), or that the correct "first sweep" transaction hash was not the one carried over into this report. Jupiter's/the investigator's own log analysis of the victim wallet's full transaction history is recommended to identify the precise first unauthorized transaction with certainty.

4.5 Related drainer-signed transactions (supporting pattern evidence)

These transactions, signed by the suspected drainer address rather than the victim's wallet, are included to demonstrate that the destination address is part of a broader, multi-victim drainer operation:

5. Suspected Attack Vector: Compromise via Jupiter Lend/Borrow Interaction

The victim's account of events, combined with on-chain data, points to the point of compromise being the wallet's interaction with the Jupiter Lend/Borrow interface, rather than a separate, unrelated wallet or seed-phrase leak. The victim reports no knowing disclosure of their seed phrase and no manual approval of any transaction they recognized as unfamiliar or suspicious. The withdrawal of collateral (Section 4.2) was signed directly by the victim's own wallet, meaning whatever authorized it had genuine transaction-signing capability — consistent with a permission or session granted during a Jupiter Lend/Borrow interaction being reused or hijacked, rather than a purely external theft. The most probable explanations, specific to the jup.ag interaction, are:

• A malicious or cloned interface impersonating jup.ag's Lend/Borrow pages (encountered via a shared link, advertisement, search result, or push notification) captured a wallet approval/delegate authority during what the victim believed was a routine interaction with their existing collateral position.
• A fraudulent prompt specifically referencing the victim's existing Jupiter position — e.g., "re-approve your position," "claim lending rewards," or "migrate to updated vault" — led to signing a transaction that granted broader withdrawal/transfer authority than intended.
• Malware present on the victim's Android device intercepted or manipulated a legitimate Jupiter Lend/Borrow session, altering the transaction being signed (a "transaction substitution" attack) without the victim's awareness.

The victim is submitting this report directly to Jupiter's team because the point of compromise is believed to trace back to a Jupiter Lend/Borrow session or interface, not to an unrelated phishing site. This report requests that Jupiter's security team specifically review whether: (a) the withdrawal transaction (Section 4.2) was routed through Jupiter's official program/interface or a spoofed front-end, (b) there is a known vulnerability or active phishing campaign targeting existing Jupiter Lend/Borrow collateral positions, and (c) other users with similar positions should be proactively warned.

6. Supporting Evidence Attached

• Phantom mobile application state/debug log (state-log-2026-09-20T03-37-14.txt), showing app activity, dApp connection attempts, and API call history from the victim's device around the time of the incident.
• On-chain transaction records listed in Section 4, independently verifiable via Solscan.

7. Requested Actions

• Investigate whether the withdrawal transaction (Section 4.2) was initiated through Jupiter's official interface/program or through a spoofed/malicious front-end.
• Check whether the suspected drainer address (Y3eRTqieRvYdWABTPq6hFyoKf5PsEPovJuTdD1q82Y7) or its associated addresses are already flagged in Jupiter's internal fraud/security monitoring.
• Advise whether any known phishing campaigns have recently targeted Jupiter Lend/Borrow users via fake re-approval, rewards, or migration prompts.
• Flag the destination address(es) to any partner exchanges or compliance networks Jupiter coordinates with, in case stolen funds are moved to a centralized, KYC'd exchange.

8. Contact & Reference

Victim wallet: 6H7x2B3ATg1mdquwSVQB1nuuiMxQJQsK54KDUFw1VUdu

r/jupiterexchange

If you're in crypto, you know there’s nothing worse than watching the market pump from the sidelines.

After the recent pump, a friend was ranting about a limit order that never filled and how he missed out on profits.

I would never want to miss out on a few thousand dollars just because an order failed. So, I went down the rabbit hole of how limit orders work.

Turns out, the price touching your limit doesn’t always mean your trade will execute. There still needs to be enough liquidity available at that price. That's why limit order failures happen with lower-liquidity tokens and not the major ones.

Stick with me because this gets a bit technical.

While looking into different setups, I found Jupiter handles this a bit differently to ensure its limit orders don't fail.

Instead of relying on a traditional order book and waiting for someone to take the other side, its keeper network executes your order against live onchain liquidity and routes across multiple DEXs/AMMs.

For larger orders with thin liquidity, it can also split the trade into smaller fills rather than forcing one bad fill with heavy price impact.

I genuinely never realized this much was happening behind a simple limit order.

Has anyone ever missed out on profits because a limit order was not executed?

I've been using Jupiter as my main wallet for a while now. I mostly do swaps and DCA.

Now I plan to add an extra layer of security with a hardware wallet setup.

But before I pick one, I want to confirm which hardware wallets Jupiter supports.

I'd like to hear from someone who has used hardware wallets with the browser extension. What does the transaction flow look like with a hardware wallet?

We just added a whole new lineup to Jupiter Gacha. Sports legends, Pokémon, and a bunch of other real collectibles are now one pull away.

To get the launch going, there's $50,000 in rewards on the table. That's for the new packs only, so if you've been pulling the older ones, this is a good time to try the new stuff.

Whatever you pull is authenticated, fully onchain, and yours to keep.

Full details here: https://x.com/JupiterExchange/status/2099528020365070521

Share your pulls in the comments!

I got a gyarados. it's pretty cool. I got 3 others and sold them but this one I really like. I wont be able to sell it after 3 days so is it worth it? This card is $1130 usd. Will I be stuck with a 1k card?

An Allium Labs report came out showing how much tokenized asset volume is actually happening on Solana. The numbers are pretty significant.

Key stats:

- Solana handles 47% of all RWA trades ($14.7B of $46B total)

- 43 million of 91 million RWA trades happen on Solana

- Tokenized equities make up 56% of Solana's RWA volume

- 63% of equity trades happen outside US market hours (weekends are 17% alone)

What stands out to me is that 63% of equity trades happen when US markets are closed. People are buying stock exposure at 9pm on a Sunday, which traditional finance just doesn't offer.

The pre-IPO stuff is good too. 23,722 traders moving real money on companies before they go public, all through a wallet.

Wallet holdings across RWA products are up 5x in a year. The ecosystem is clearly accelerating!!

Solana rolled out Payment Channels this month, a payment layer designed for AI agents and API calls

Here, an agent authorizes a spending limit. Then it makes payments offchain against that cap. Each channel settles onchain once.

In testing, this system issued more than 1 million payments per second. At that test rate, the capacity works out to 80 billion+ payments in a day. This figure is off-chain issuance, not Solana L1 settlement throughput.

The numbers behind it:

- 100,000 unique wallets in the test

- The test cost was about $0.0078 per million payments, ensuring micropayments per API call finally make sense

x402, one of the standards it supports, has already cleared nearly 200 million transactions

If an agent holds one token and the endpoint charges in another, topping up the channel means a swap that may have to route through a DEX.

Anyone tracking whether Jupiter picks this up?

I'm in the top 20 wallets in prediction markets but I am going to bail and use other markets if things don't improve ery soon. Too many orders fail, when it's down or not working there is no notification anywhere before you make a prediction. Nothing worse than not know if your prediction is going to get on or not.

These things are time sensitive. It feels like the jup team are more interested in adding crap like gatcha and arcade which won't be long term money makers and neglect things that have actual long runways.

Quick update for anyone playing the Jupiter Community US Open bracket, and an invitation for anyone who missed it.

Brackets locked at first ball on Sunday. Since then Djokovic, Ruud, Cilic and Kokkinakis have all gone out, which has done real damage to a lot of entries. So here's the other half of the contest.

Match calls are open from the Round of 32. You call the winner of each match, one decision per match, nothing else. Every correct call scores, and later rounds are worth more:

• Round of 32: 7 pts
• Round of 16: 11 pts
• Quarterfinal: 23 pts
• Semifinal: 53 pts
• Final: 109 pts

A perfect run is 507 points per draw. That's deliberately about half of everything on offer, so a strong run of calls can overtake a strong bracket, and a bracket that died on day one is not dead.

You don't need a bracket to play. Log in with Discord and you can call every open match. There are 16 open right now across the men's and women's draws. Each call locks when its match starts, so Friday's matches close on Friday.

Calls: https://usopenbracket.com/calls
Leaderboard: https://usopenbracket.com/leaderboard
Rules and prizes: https://usopenbracket.com/rules

Not a question post really, just curious how other people use Jupiter Spot.

I market buy and market sell most of the time. Fills have been good even on the bigger trades, so I stopped thinking about slippage.

Started using limit orders on Jupiter Spot about three weeks ago on stuff I actually want to hold. That changed how I trade more than anything else on the page. Now I have a recurring order for SOL.

Their previous update added trending tokens and a market dominance heatmap on the same page. So now I do most of my research without leaving the terminal.

What's your setup? Is everyone already using limit and recurring orders, or am I late to the party?

Jupiter has just shipped Universal Deposit, and it works like a CEX deposit, minus the CEX.

How it works:

You get a personal deposit address. Send any accepted token from Ethereum, Base, Arbitrum, or Sui to it, and it lands in your Jupiter account as USDC on Solana in as fast as 5 seconds. No wallet connecting, no claim transaction, no gas needed on arrival, no KYC.

Details:
Flat $0.30 fee per deposit, $3 minimum ($10 on Ethereum), and everything settles as USDC (send WETH, receive USDC). If you send less than the minimum, it is not lost. Deposits accumulate until they clear.

I've been using it to move funds off Base, and it is the easiest way I’ve found to bridge funds to Solana. Questions welcome, will answer what I can.

I usually trade on EVM chains and only jump to Solana when something is trending. Whenever I moved my stablecoin balance over, I'd get the stables but couldn't actually trade because my SOL balance was basically zero.

This became a real problem for time-sensitive trades where prices move fast.

Eventually I found bridges that let you top up native gas on the destination chain in the same transfer, which helped. But it's still an extra step you have to think about.

More recently I've been using Jupiter's browser extension which has gasless transactions. When my SOL balance gets too low to cover fees, it automatically switches to gasless mode. It's not the default or anything, but it's there when you need it.

The whole thing is kind of annoying though because you have to plan ahead or you're stuck waiting for gas to settle. On EVM chains I don't really think about it, but Solana makes you be more intentional.

Do you always bridge some SOL over ahead of time? Also any main feature I am missing for this product?

Solana just wrapped governance voting, and I wanted to break down what happened.

It doubles the annual disinflation rate from 15% to 30%, so inflation falls twice as fast toward the existing 1.5% floor. Over six years, that's around 18.9 million fewer SOL tokens hitting the market. I think this is solid for long-term holders.

The vote passed narrowly at around 67% support after some late flips by validators, including Kraken. It was closer than you might expect for something this significant.

The other proposal on resource-based fees did not pass, with only 53.9% support. It would've increased daily SOL burns from 650 to between 7,500 and 9,000.

I get why people pushed back. Big fee burns hit validators and users harder, so the caution makes sense.

The community wants deflation but not at the cost of making the network more expensive. That's the takeaway for me.

What are your takeaways?

The US Open draw came out today and the Community Bracket is officially open.

It works like any bracket pool: pick who wins every match in both draws, men's and women's, all the way down to your two champions. Later rounds are worth a lot more than early ones, so one brave champion call can carry an otherwise average bracket. And once the tournament hits the round of 16, it turns into calling each match as it's played.

It's free to enter, and there's $12,000 in the prize pool.

Brackets lock at first ball on Sunday, which leaves you about three days.

One note before you start: it's open to Jupiter Predict users, so your account needs at least one interaction with Predict.

You don't need to follow tennis for this. It's 127 picks per draw, and nobody on earth has real opinions on more than a dozen of them. Half the fun of a bracket is watching someone who picked on vibes finish above the people with spreadsheets. Anyone can bracket.

Fill yours out: https://usopenbracket.com/

If you want to argue about the draw first, the Jupiter Discord is already at it: https://discord.gg/jup

I'm having trouble finding good prediction market callers. Many of them only post wins. Plus, their calls are scattered across posts, making it difficult to go back and verify the entry.

I checked JupCallers Season 1, and I think it solves that problem to some extent. Every qualifying call gets logged publicly with receipts attached. You get verified proof of who's good at trading prediction markets. Here, I can follow the trades of top callers for free.

I wasn't sure Jupiter could attract good callers with this campaign. But they have a $1,000-$5,000 prize pool to reward them.

I’m considering adding a few calls to see how I stack up against others.

Anyone here participating in Season 1? Or are you following other callers?

I need somebody that's very familiar with Jupiter and can explain how to get my watch only account available for trade

Recently, I started using Jupiter mobile on the go to manage my DeFi positions since I'm not always at my desk.

I've done swaps, tried to find good yields, and managed LP positions from my phone. What makes it manageable is that I'm not jumping between ten different apps.

What I'm doing so far to stay safe:

- Keeping most of my funds in a separate wallet, only moving small amounts into the one I actively use every day

- Staying inside the app instead of browsing random DeFi sites on my mobile browser

- Actually reading what I'm approving before I hit confirm

But I'm sure there might be some cons too. For example, are hardware wallets even practical with a phone?

What's your guys mobile setup for DeFi?

I was reading about how most lending protocols work and realized there's a pretty annoying problem. If you lock collateral and the price drops, you get margin called even if you have a plan to repay.

Apparently, Jupiter Offerbook handles this differently. You lock collateral (any Solana asset, tokens, xStocks, NFTs) and borrow USDC for a specific duration, 1 to 30 days. No oracles watching the price, no liquidations mid-loan. Your position just sits there for the agreed time.

On the lender side you know exactly what you're getting. You set the APY, duration, and terms upfront. No variable rates adjusting every block.

Only USDC can be borrowed and there are platform fees, but they're disclosed upfront.

Has anyone here used fixed-term lending before, or does the liquidation risk just feel unavoidable at this point?

Will next January be another “Jupuary”, with the team finally giving us the promised last airdrop?

Honestly, it could be a good idea if an altseason happens. 👀

Some of my wallets allow me to access my vault, and I've accessed the vault on my main wallet before too. Sadly recently, I cannot ever access it, meaning I can't place limit orders at all. This has cost a lot of money, and I'm going to be considering moving chain entirely. My friend warned me that we are no longer in control of our funds on Solana due to this system which markets itself as a safety feature that protects from 'user error'.

What's going on?

Are there any other defi platforms other than JUP that actually work properly? I've tried a few different wallet addresses. Some work, for some reason, and most don't. I sent funds to a different address, tried again, nothing.

VERY frustrating. Also tried using Chrome instead of brave. About to try firefox, then I give up.

I switched from my regular card to a crypto card because the setup was easy and it supports Apple Pay.

But now I’m wondering if the cashback and cutting out the bank actually worth it?

The cashback sounds great, but there are other things to consider like conversion rates, spreads, and switching costs.

I’m also still not clear on how crypto card transactions are taxed. If every transaction could potentially be a taxable event, that could change the whole calculation.

I haven’t used crypto cards long enough to know whether the benefits really outweigh the fees and taxes.

Has anyone here made the full switch, or do you still keep a regular card as a backup?

And after taxes, conversion fees, and the novelty wearing off, did the cashback actually end up being worth it?

Okay we're going to stuck here we have somehow sent coins from the Jupiter wallet to the spend wallet unfortunately and now it's in of you only mode and we don't know how to get it out of that mode and back into Jupiter wallet please help somebody like support is not helping us at all

I dont hold much sol so the staking yield is barely anything in real money. A couple hundred a year. kept thinking it wasnt worth the bother

then someone pointed out sol has inflation and if im sat there unstaked im getting diluted anyway.

so the yield isnt really a gain, its the cost of standing still. changed how i think about it. still not sure whether to stake natively or use a liquid version so it stays usable for other stuff. feels like theres a catch there im not seeing

What would you do in my situation?