JupiterDAO $MEOW Token Rug Pull Jokes From Twitter/X

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Jupiter Exchange Logo/Homepage

Jupiter Exchange is a dynamic project focused on developing a decentralized ecosystem driven by community participation. Its strategic vision, J.U.P. (Jupiter United Planet), is designed to integrate the strengths of users, teams, working groups, and its upcoming DAO to propel the project and the cryptocurrency space forward. Recently, the exchange's Twitter account was compromised, but the team quickly regained control. Fortunately, no customer funds or sensitive data were at risk, and the issue was contained to Twitter alone. Despite stringent security measures, the team is still investigating how the breach occurred without triggering any security alerts.

About Jupiter Exchange

J.U.P, or Jupiter United Planet, is a strategic vision aimed at building a dynamic and synergistic community to propel Jupiter and the cryptocurrency ecosystem forward. The project, which has been evolving for a while, is entering a critical phase with the upcoming launch of its DAO (Decentralized Autonomous Organization). The initiative seeks to blend the strengths of small, talented groups, community energy, and DAO legitimacy into a unified effort for growth.

Jupiter began as a product-focused project, where its early success was built on providing the best user experience, selection, and price, with strong feedback loops between the users and the development team. This foundation allowed Jupiter to establish a world-class product suite. Now, the focus is shifting towards building a full-stack ecosystem. This involves transitioning from a single product to a range of interconnected efforts aimed at accelerating the decentralized meta, requiring distributed networks of talent working towards a shared goal.

J.U.P is structured around five key components: 1) Users, who are the foundation of the project and whose feedback and support have been integral to its success; 2) Team, the dedicated builders behind the platform; 3) Working Groups, which are small teams within the community focused on executing specific tasks related to community management, ecosystem processes, and communication; 4) Catdets, community members who embody the long-term vision of decentralization and are key to fostering a supportive and collaborative culture; and 5) DAO, which is set to launch soon and is expected to bring distributed governance and proactive, unbiased decision-making to the project.

Ultimately, J.U.P is an experiment in distributed execution of strategy, leveraging the strengths of each component to create a holistic and robust community. As the project progresses, it aims to drive Jupiter and the decentralized meta forward. The community's involvement is essential, and the project's creators are excited for the potential of this experiment.

The Reality

An unknown vulnerability was able to allow someone into the Jupiter Exchange account.

What Happened

The Twitter account of Jupiter Exchange started posting at least one $MEOW token and various other posts.

Key Event Timeline - JupiterDAO $MEOW Token Rug Pull Jokes From Twitter/X

Date	Event	Description
February 5th, 2025 6:02:04 PM MST	Meow Token Smart Contract	One of the MEOW tokens is launched on Solana, with the first tokens minted.
February 5th, 2025 6:27:00 PM MST	JupiterDAO Tweet Posted	"The main @JupiterExchange account appears to be compromised. Do not click any links. Do not copy paste any CA's. Be careful!"
February 5th, 2025 11:21:00 PM MST	Account Recovery Tweet Posted	Jupiter Exchange posts on Twitter/X to notify their community that they have now recovered the account. The incident is isolated to Twitter/X only. The team lead weremeow confirms the account is recovered and promises a full post mortem.
February 6th, 2025 6:16:00 AM MST	Update PostMortem Provided	Jupiter Exchange updates their community with a post mortem regarding a recent Twitter hack. Despite stringent security measures, including strict access control, 2FA, and real-time alert monitoring, the account was still taken over without triggering any email notifications. The team is investigating the cause, as there was no sign of a straightforward hack on their personal or organizational accounts. They are actively exploring all possibilities and will provide a full post mortem once they have more information. Importantly, no funds or sensitive information were at risk.

Technical Details

AXUkvPzQhJdS2w5t6XfVjgWy1fXtrsVDFByMVgoyeveP

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

"JupiterDAO confirmed on X that the official Jupiter X account (@JupiterExchange) has been compromised. Users are advised not to click on any links or copy-paste any contract addresses."

"The main @JupiterExchange account appears to be compromised. Do not click any links. Do not copy paste any CA's. Be careful!"

Ultimate Outcome

"we've regained control of our account.

to be clear: no customer or treasury funds were ever in danger. all programs and funds are in held in secure multisigs. no other comms channels were affected.

and, thankfully, all of our team members are safe.

jupiter is fully secured. this issue was isolated to twitter alone.

we've got it under control. will update as we learn more."

"In short, our Twitter security measures were stringent and implemented properly at every level. And further, all Jupiter products and team members were safe and no funds or info were ever at risk.

The account takeover was completed without triggering any email notifications. This is very strange, and we’re still trying to figure out what happened.

For Twitter alone, we had the following security measures in place: - Strict access control (only 3 people on our team had access to the account) - Usage of “Delegate” feature to limit team member’s ability to change security settings - 2FA for each individual with access to the account - 2FA for the main handle, stored in 1Password and only accessible via a different password (and protected from any simswap attacks) - Realtime alert monitoring via BetterStack - Backup email notification system with multiple recipients for critical notifications - Partnership with an external security firm - Complex passwords with numbers, letters, and symbols - Enterprise security on our password management - Detailed audit logging

So if we had such tight security, how did this happen?

We have an idea, but we’re still waiting for confirmation. But it is quite unlikely that it was due to a security lapse on our end.

Here’s why we say that: the hacker was able to temporarily lock us out of the account by changing the password or email.

Normally, if either email or password is changed by a user, an email notification is sent to the account owner’s previous email (and, in our case, forwarded to multiple people for redundancy).

However, no email notification was sent whatsoever. We even checked the Google Workspace audit logs in case the hacker had accessed our email and deleted the notification. But there was nothing.

Right now, we do not know how the attacker took over the account without triggering any notifications, but we don’t think it’s via a straightforward hack of a personal or organizational account.

We are currently in the process of chasing down every single loose end and possibility, will send a full post mortem log when we can."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

It does not appear that Jupiter has posted any additional information of follow up on the hack. They also do not appear to have done anything to compensate victims.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.