Skip to main content
A phone with crypto coins on a fishing hook, the cover of this lesson Phishing in crypto works the way it does in banking: someone impersonates a source you trust to trick you into handing over your keys or approving a malicious action. The difference is that onchain there is no chargeback. Once a transaction is signed and confirmed, it is final. Social engineering is the human side of phishing. A scammer builds trust first, sometimes over days or weeks, then makes a move. In crypto this happens most often in Discord, Telegram and X direct messages, where scammers pose as moderators, support staff or helpful community members.
A masked character labeled Fake Support asks "How can I help you?" to a smiling user

Fake support is one of the most common openings.

​
Common phishing attacks

  • Fake websites: a copy of jup.ag or another trusted site, at an address that differs by a character or two, such as jup-ag.com or jupit3r.io. The page looks identical but is built to get your wallet’s approval.
  • Fake support DMs: someone offers to help after you post a question in a public channel. They send you to a fake site, or ask for your to “troubleshoot”.
  • Fake giveaways: “Send 1 SOL, get 2 back”, or a DM or reply asking you to “connect your wallet to claim your airdrop”. Legitimate projects never ask you to send funds in order to receive funds, and real claims happen only on the project’s official site.
  • Offers to buy your old wallets: scammers offer SOL for old, empty wallets. You are unlikely to be paid, and the wallets can be reused in other scams, for example to make a token look popular before a .
  • Impersonation accounts: X or Telegram accounts whose name and picture are nearly identical to official Jupiter accounts. They reply to your posts with urgent links.

​
How to protect yourself

  • Bookmark the official Jupiter sites and open them only from your bookmarks. Do not follow links from DMs or social media.
  • Check the address in your browser before you connect your wallet. Look for misspellings and swapped characters.
  • Remember: nobody from the Jupiter team will ever DM you first. If someone does, assume it is a scam, especially if they offer support, a giveaway or a link.
  • Turn off direct messages from strangers on Discord and Telegram.
  • When in doubt, open a ticket from the Support Hub or ask in a public channel of the official Jupiter Discord, never in a private thread someone else opened.
  • Never type your seed phrase or private key into a website, a form or a chat. Your wallet only needs it when you import a wallet into it.

​
How Jupiter Wallet helps

Jupiter Wallet adds two checks when a site asks you to sign. It flags transactions that look risky or malicious, and it filters out hidden transfers to known malicious addresses that a rogue browser extension may inject. Neither replaces checking the site and what you are approving. See Risk warnings and Transaction Protection.