# Is Jupiter safe? Check before you connect

> Jupiter: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-28.

Canonical: https://tradingagentstack.com/check/jupiter/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Jupiter

# Is Jupiter safe to connect?

Web trading terminal · Solana, Perps: SOL, ETH and wBTC against the JLP pool (up to 250x), plus beta markets run on GUM. Checked 2026-10-28; every line links its source.

**Worst case:** Jupiter is self-custody, so a leaked recovery phrase, or signing on a fake 'Jupuary'/allocation claim site, can empty your wallet, and Jupiter can't recover it. A Jupiter ID wallet is lost for good if you lose its social login. In the extension, Auto-Approve is on by default for Jupiter's own sites, so a bad transaction there can be signed without you seeing it. Perps up to 250x can be liquidated, and fills depend on keepers Jupiter runs. In 2025 the official X account itself was hijacked to push scam tokens.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Use only jup.ag, and install only from the links in Jupiter's docs: Chrome Web Store ID iledlaeogohbilgbfhmbgkgmpplbfboh (publisher extension@jup.ag), App Store id6484069059, Google Play ag.jup.jupiter.android. Jupiter says any other installer 'claiming to be Jupiter Wallet' is not official. Ignore airdrop or 'claim' links, even from an official-looking X account.

2. Write your recovery phrase down offline (Jupiter Mobile has no cloud backup). If you use Jupiter ID / Quick Accounts, export the private key on jup.ag and back it up, because losing the social login loses the wallet.

3. In the extension, open Settings → Preferences → Auto Approve: turn it off, or set a spending limit and notifications, and revoke unused sites under Settings → Security → Connected Apps. Give bots a separate small wallet, and keep larger holdings on a Ledger, Trezor or Keystone, which always ask for confirmation.

## What it can do with your money

| Who holds the keys | You hold the keys Jupiter Wallet (extension) and Jupiter Mobile are self-custody: 'Your private keys and recovery data are stored only on your device' and 'Jupiter never stores, accesses, or transmits your keys.' On jup.ag you sign with your own wallet. Jupiter ID / Quick Accounts (social login) have no recovery phrase: Privy, a third party, handles login and key management, and if you lose that login 'there is no way to recover the wallet.' In Perps, your collateral and the borrowed part of the position sit in Jupiter's Perps program against the JLP pool, and Jupiter-run keepers execute trades and limit/TP/SL orders. [source](https://docs.jup.ag/user-docs/manage/extension-wallet/security) |
| --- | --- |
| Can funds be sent out to any address? | Yes. You sign every send yourself, to any address. Exception: the extension's Auto-Approve is ON by default for jup.ag, vote.jup.ag, lock.jup.ag and verified.jup.ag. It signs there without showing the approval screen unless the transaction is above a spending limit you set (the default can be 'No limit'). Hardware wallets always ask for confirmation. [source](https://docs.jup.ag/user-docs/manage/extension-wallet/settings.md) |
| Can it hold or freeze your funds? | Jupiter can't reach a self-custody wallet's funds, but the app can restrict what you do in it: Jupiter Mobile has regional and token restrictions, and a 'flagged' wallet has to open a ticket at support.jup.ag for review. Perps trades and limit/TP/SL orders only fill when Jupiter's offchain keepers process them (two run in parallel), and the docs don't say what happens if keepers stop. Ultra Mode sends your signed swap privately for MEV protection, which the docs say lowers MEV risk but doesn't remove it. Jupiter's docs say Jupiter can't recover a lost wallet. [source](https://docs.jup.ag/user-docs/global/mobile/faq.md) |
| What a leaked API key can do | Jupiter's developer APIs (Swap, Trigger, Recurring, Perps, Lend) take an API key in an x-api-key header from the portal at developers.jup.ag/portal, per Helius's integration guide. A bot still signs every transaction with a wallet key, so that wallet key is what to guard. We found no Jupiter page saying what an API key alone can do. [source](https://www.helius.dev/docs/agents/skills/jupiter.md) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `jup.ag`

- X: `@JupiterExchange`

- X: `@jup_mobile`

- GitHub: `github.com/jup-ag`

- App: `https://chromewebstore.google.com/detail/jupiter-wallet/iledlaeogohbilgbfhmbgkgmpplbfboh`

- App: `https://apps.apple.com/us/app/jupiter-mobile-solana-wallet/id6484069059`

- App: `https://play.google.com/store/apps/details?id=ag.jup.jupiter.android`

Where we confirmed these
- https://docs.jup.ag/ (vendor docs: footer links x.com/JupiterExchange, discord.gg/jup, t.me/jup_dao, youtube.com/@JupiterOnchain; header links support.jup.ag)

- https://docs.jup.ag/user-docs/manage/extension-wallet/getting-started.md (vendor docs: Chrome Web Store iledlaeogohbilgbfhmbgkgmpplbfboh, 'Install only from the Chrome Web Store', publisher extension@jup.ag; App Store id6484069059; Google Play ag.jup.jupiter.android; 'Any other links, installers, or download packages claiming to be Jupiter Wallet are not official')

- https://docs.jup.ag/user-docs/global/mobile/faq.md (vendor docs: Google Play ag.jup.jupiter.android, App Store id6484069059, links x.com/jup_mobile, support at support.jup.ag)

- https://developers.jup.ag/docs/ai/skills.md (vendor developer docs: github.com/jup-ag/agent-skills)

- https://apps.apple.com/ca/app/jupiter-mobile-solana-wallet/id6484069059?l=fr-CA ('Jupiter Mobile - Solana Wallet', seller Raccoon Labs Pte. Ltd., developer website jup.ag/mobile, privacy jup.ag/mobile/terms, v3.22.0); Apple short link apple.co/4exsMlz also redirects to id6484069059

- https://play.google.com/store/apps/details?id=ag.jup.jupiter.android&hl=en_CA ('Jupiter Mobile - Solana Wallet', developer Raccoon Labs / RACCOON LABS PTE. LTD., Singapore, developer website jup.ag, 500K+ downloads, updated 2026-10-14)

- https://chromeboard.com/extension/jupiter-wallet-iledlaeogohbilgbfhmbgkgmpplbfboh (Chrome Web Store mirror: 'Jupiter Wallet', iledlaeogohbilgbfhmbgkgmpplbfboh, 'Built by Jupiter Exchange', 100K+ users, v1.19.0, 2026-09-17)

- https://www.quicknode.com/fr/builders-guide/tools/jupiter-aggregator-by-jupiter-core-team (QuickNode listing: website jup.ag, GitHub github.com/jup-ag, X x.com/JupiterExchange, Discord discord.com/invite/jup)

- https://github.com/jup-ag/cli and https://github.com/jup-ag/plugin (repos owned by the jup-ag org; plugin's About links terminal.jup.ag)

- https://cryptopotato.com/jupiter-exchange-regains-x-account-following-hack/ (news, 2025-02-06: the recovered main account links to @JupiterExchange, over half a million followers)

- https://www.theblock.co/post/339128/solana-dex-aggregator-jupiters-x-account-hacked-promotes-fake-memecoin (news, 2025-02-05: names @jup_mobile as Jupiter Mobile's X handle)

### Known fakes

- `jupag.pro` · 2026-05-21 [source](https://www.pcrisk.com/removal-guides/35327-jupiter-allocation-scam)

- `jupgifts.com` · 2025-08-28 [source](https://www.pcrisk.com/removal-guides/33024-jupiter-jup-rewards-scam)

- `nftsclaimjup.com` · 2025-08-28 [source](https://www.pcrisk.com/removal-guides/33024-jupiter-jup-rewards-scam)

- `jupclaimnft.com` · 2025-08-28 [source](https://www.pcrisk.com/removal-guides/33024-jupiter-jup-rewards-scam)

- `jupuary.jupp.digital` · 2025-02-07 [source](https://www.pcrisk.com/removal-guides/31999-jupiverse-wallet-connection-scam)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-05-22 | Fake '$CJUP' airdrop links drained Solana wallets within minutes of connecting. Solana Floor warned users, and Jupiter had announced no airdrop at that time (third-party report). PCrisk listed a similar fake 'Jupiter allocation' drainer, jupag.pro, on 2026-05-21. (third-party report) |  | warning issued; no loss total reported | [source](https://en.coin-turk.com/fake-cjup-airdrop-drains-solana-wallets-within-minutes/) |
| 2025-12-06 | Jupiter deleted a post claiming Jupiter Lend's isolated vaults had 'no contagion' risk. COO Kash Dhanda said the claim was 'not a hundred percent correct' and confirmed collateral is rehypothecated. Kamino then blocked Jupiter Lend's migration tool. (third-party report) |  | No user losses reported. Jupiter said it would publish more documentation on the vault design. | [source](https://www.theblock.co/post/381602/jupiter-exec-acknowledges-zero-contagion-claim-was-not-100-correct-after-backlash-over-vault-design) |
| 2025-02-05 | Jupiter's main X account (@JupiterExchange) was hijacked and promoted fake memecoins ($MEOW, then $DCOIN). @jup_mobile warned users not to click links or buy promoted tokens. Traders reported losing 'millions' (unverified estimate). |  | Account recovered within hours and posts deleted. Jupiter said 'no funds were ever at risk', customer and treasury assets were in multisig wallets, and the breach was limited to X. Traders' scam losses were not recovered. | [source](https://www.theblock.co/post/339128/solana-dex-aggregator-jupiters-x-account-hacked-promotes-fake-memecoin) |

## Check a link

Got a link, @handle or repo that claims to be Jupiter? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Jupiter

We email you if we add an incident, a freeze report, a known fake or a deadline for Jupiter. Free; unsubscribe anytime.

## More checks: Web trading terminals
[GMGN](https://tradingagentstack.com/check/gmgn/)[Photon](https://tradingagentstack.com/check/photon/)[BullX Neo](https://tradingagentstack.com/check/bullx-neo/)[Axiom](https://tradingagentstack.com/check/axiom/)[Padre](https://tradingagentstack.com/check/padre/)[Fomo](https://tradingagentstack.com/check/fomo/)[Genius Terminal](https://tradingagentstack.com/check/genius-terminal/)[Based](https://tradingagentstack.com/check/based-one/)[HyperDash](https://tradingagentstack.com/check/hyperdash/)[Insilico Terminal](https://tradingagentstack.com/check/insilico-terminal/)[Moonshot](https://tradingagentstack.com/check/moonshot/)[Ave.ai](https://tradingagentstack.com/check/ave-ai/)[3Commas](https://tradingagentstack.com/check/3commas/)[Bitsgap](https://tradingagentstack.com/check/bitsgap/)[OctoBot](https://tradingagentstack.com/check/octobot/)[DEXTools](https://tradingagentstack.com/check/dextools/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)