Supra Labs stated that CEO Josh Tobkin's X account was compromised on June 5. The attackers subsequently used the account to promote a fake $SUPRA token and directed users to a phishing airdrop website.
The project team reminds users not to send funds to any related addresses or connect their wallets. The team states that Supra’s official token operates on the Layer 1 mainnet launched by the project in 2024; versions appearing on social media on Solana and Ethereum are not officially issued.
Attackers used executive accounts to spread false information.
In this incident, the compromised accounts were used to post promotional content for tokens and lure users into clicking external links under the guise of an "airdrop." Such tactics are not uncommon in the crypto industry; a common approach involves gaining control of social media accounts belonging to project teams, executives, or influencers, then tricking users into interacting through fake tokens, fake airdrops, or forged announcements.
The Supra Labs team subsequently issued warnings across multiple community channels, advising users to rely on official communications and to await further updates after account restoration.
Fake tokens involve Solana and Ethereum.
According to the project team, the counterfeit $SUPRA tokens promoted by the attacker appear on the Solana and Ethereum networks. The team emphasizes that these tokens are unrelated to the official asset.
- Counterfeit tokens have been deployed on Solana and Ethereum.
- Phishing pages trick users into taking actions under the guise of an airdrop.
- The official token operates on Supra's own Layer 1 mainnet.
The project team aims to help users quickly distinguish between genuine and fake assets, preventing misidentification due to similar on-chain names or social media endorsements.
No confirmed user losses have occurred yet.
To date, Supra Labs has not confirmed any user financial losses resulting from this incident. Meanwhile, Tobkin is attempting to regain control of the account.
This incident again highlights that security risks in the crypto industry are not limited to protocol vulnerabilities or private key leaks—social engineering attacks remain one of the most common entry points for scams. For average users, the most straightforward way to verify such information as “temporary airdrops,” “limited-time claims,” or “new chain token launches” is to cross-check the project’s official website, mainnet details, and community announcements.