Web trading terminal · Ethereum, Arbitrum and other EVM chains, Solana and Bitcoin (cross-chain swaps and bridging routed through LI.FI), Perps: Jumper Perps at perps.jumper.xyz, an aggregator that routes to outside perps venues (Hyperliquid via builder codes first). Checked 2026-10-29; every line links its source.
Worst case: Jumper never holds your coins, but every swap needs a token approval to LI.FI's contract. If you ever gave that contract an unlimited approval and it gets a bad upgrade again, as in 2022 and 2024, the attacker can pull those tokens straight from your wallet without you signing anything new. A look-alike site (jumepr.xyz, jymper.xyz, jumper-exchange.org) or a fake 'JUMP claim' or 'xPerps' page can drain whatever you approve or sign there. A bridge transfer can get stuck on a third-party bridge LI.FI takes no liability for, and perps routed to outside venues can be liquidated.
Type jumper.xyz yourself and bookmark it (jumper.exchange only redirects there). Follow @jumperapp, and ignore any airdrop, JUMP claim or xPerps-conversion link Jumper has not announced on jumper.xyz.
Approve only the exact amount for each swap, never 'unlimited'. Then check revoke.cash (it has a LI.FI exploit checker) and revoke any old LI.FI or Jumper approvals you don't need, especially from before July 2024.
Use a separate hot wallet holding only what you are swapping, bridging or trading right now, and keep long-term holdings on a hardware wallet that never approves LI.FI contracts.
What it can do with your money
Who holds the keys
You hold the keys Jumper is a front end: you connect your own wallet and sign each swap or bridge yourself. Jumper's footer links LI.FI's terms, which say 'The LI.FI Smart Contracts operate fully non-custodial' and that the user 'is fully responsible for safeguarding digital assets and cryptographic keys'. To swap an ERC-20 you approve LI.FI's contract (the LI.FI Diamond) to spend that token. LI.FI says finite approvals are the default in its API, SDK and widget, but any infinite approval you gave stays live until you revoke it, and both LI.FI exploits drained exactly those. Bridge legs run through third-party bridges, and LI.FI 'disclaims any liability for such Third-Party Contracts'. Datawallet says 'Customer balances are never held by Jumper' and that Jumper's perps first route to Hyperliquid through builder codes, so perps collateral sits on that venue, not with Jumper. source
Can funds be sent out to any address?
Yes. You sign every swap and bridge yourself, and the destination address can be any address you enter. A token approval you gave LI.FI's contract can be used without a new signature from you: in 2022 and 2024, bugs in newly added contract code let attackers pull tokens from wallets with old infinite approvals (153 wallets in 2024). Finite approvals were not affected. source
Can it hold or freeze your funds?
LI.FI can't freeze tokens in your wallet, but it can change and switch off parts of its upgradeable contracts: on 2024-07-16 it 'disabled the vulnerable facet across all chains', and it told users not to use LI.FI-powered apps until then. LI.FI's terms let it 'modify, enhance, or otherwise update' the software, and you agree to 'cease use of the Services' on its reasonable request. You also warrant you are not sanctioned and not a US citizen. Jumper Perps is not available to US persons (Today in DeFi; IQ.wiki). A bridge transfer that stalls depends on the third-party bridge, and LI.FI disclaims liability for those contracts. source
Official links
Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.
Website: jumper.xyz
Website: jumper.exchange
X: @jumperapp
GitHub: github.com/jumperexchange
Where we confirmed these
https://jumper.xyz/learn/jumper-new-domain-jumper-xyz (vendor post: 'We've updated our domain from Jumper.exchange to Jumper.xyz'; 'The jumper.exchange domain will remain under our control and all corresponding URLs will start redirecting to their respective jumper.xyz URLs'; footer links terms at li.fi/legal/terms-and-conditions and privacy at jumper.xyz/privacy-policy; socials collected at link3.to/jumperexchange)
https://github.com/jumperexchange/jumper-exchange (About: 'Jumper - Multi-Chain Bridging & Swapping', website jumper.xyz; repo archived, development moved to a private repo)
https://www.alchemy.com/dapps/jumper-exchange (Alchemy dapp listing: website jumper.exchange, X @jumperexchange)
https://iq.wiki/wiki/jumper (IQ.wiki: website jumper.xyz, X x.com/jumperapp, Telegram t.me/jumperapp, Discord discord.gg/jumperexchange, LinkedIn jumper-app; Jumper Perps at perps.jumper.xyz; September 2026 spin-out from LI.FI)
https://www.coingecko.com/en/coins/jumper (CoinGecko JUMP page, not yet trading: website jumper.xyz, whitepaper docs.jumper.xyz, X twitter.com/jumperapp)
https://crypto.news/jumper-sets-sep-29-date-for-jump-token-sale-on-legion/ (news, 2026-09-25: links Jumper's sale announcement at x.com/jumperapp/status/2103481417070203369)
https://www.manilatimes.net/2026/09/26/tmt-newswire/globenewswire/jumper-to-launch-jump-token-sale-on-legion-as-it-spins-out-to-build-the-super-app-for-onchain-finance/2433480 (GlobeNewswire release, 2026-09-25: 'For more information, visit https://jumper.xyz/'; CEO Marko Jurina; 'Originally incubated within LI.FI')
https://www.coingecko.com/learn/what-is-jumper-potential-jumper-airdrop (CoinGecko Learn, updated 2024-07-31: links jumper.exchange; 'a user-facing product launched by LI.FI')
https://www.techworm.net/2024/07/li-fi-protocol-exploit-jumper-draining-10-million.html (news, 2024-07-16: quotes Jumper's post from @JumperExchange during the LI.FI exploit)
Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.
Date
What happened
Amount
Outcome
Source
2024-07-16
LI.FI exploit: GasZipFacet, a contract facet added five days earlier, lacked the call whitelist the other facets use. An attacker made arbitrary calls through it and drained USDC, USDT and DAI from 153 wallets on Ethereum and Arbitrum that had given LI.FI infinite approvals. LI.FI blamed 'an individual human error' in deployment. Jumper (@JumperExchange) told users 'Please do not interact with our platform right now!' and to revoke approvals.
~$11.6M (LI.FI's estimate; Rekt put it at ~$9.73M)
LI.FI disabled the facet on all chains the same day and said finite approvals were never at risk. On 2024-07-18 LI.FI said it was working on a voluntary plan to reimburse 100% of affected users with backing from its major investors (Cointelegraph). We found no official notice confirming the payouts were made; Datawallet (2026) says affected users were compensated.
LI.FI exploit (02:51 UTC): the pre-bridge swap feature accepted arbitrary addresses and calldata, so the attacker called transferFrom on token contracts and pulled tokens from 29 wallets with infinite approvals to the LI.FI contract.
~$600K (205 ETH)
LI.FI disabled the swap methods, upgraded the contract with a DEX whitelist and made finite approvals the default. All 29 wallets were reimbursed: four were offered conversion into an angel investment, and one partly accepted. The stolen funds stayed with the attacker.
What Jumper collects and can see about you, and any past breach of customer data, so you know what could leak and what to watch for. From its own privacy policy, docs and notices, checked 2026-10-29. source
What it collects
Server logs on every visit: browser type and version, operating system, host name, access date and time, and IP address (Jumper says these are 'not merged with other data sources' and not used for marketing)
Contact data you send (name, email, message) and, if you subscribe, your newsletter email plus open/click tracking, IP address, browser, device type and OS
What you share with Jumper's pages on LinkedIn, X, Telegram, GitHub, Discord and Medium
What it can see
Jumper (the data controller, under GDPR and Germany's BDSG; supervisor: the Berlin data-protection commissioner) sees your IP and browser data on every visit. Its processors include AWS, Cloudflare, Namecheap, MongoDB Atlas, Substack, Tally and Google Analytics, and data may go to the USA under EU standard contractual clauses. The policy (updated 2026-10-28) does not mention wallet addresses or cookies, so it doesn't say whether your connected address is logged next to your IP. Every swap, bridge and approval you make is public onchain and tied to your address.
Past data breaches
None found in the vendor's notices or reputable reporting as of 2026-10-29. That doesn't prove nothing happened.
Check a link
Got a link, @handle or repo that claims to be Jumper? Paste it to see if it's on the official list.
Checking links inside Telegram? Send them to @TASCheckBot, or add it to your group so anyone can type /check. Alerts on new drains and fakes: @tradingAgentStk.
Get an alert for Jumper
We email you if we add an incident, a freeze report, a known fake or a deadline for Jumper. Free; unsubscribe anytime.