CZ cautions that attackers are hijacking verified social accounts to post fake “official” meme-token announcements. Funds are being drained. Here’s a short, plain-English guide to verify sources, do out-of-band checks, and avoid connecting your wallet to random sites

In a new cautionary post, Binance cofounder Changpeng “CZ” Zhao warned that rising memecoin hype is attracting attackers who hijack social media accounts and publish fake “official” token announcements. People are clicking, connecting wallets, and losing funds. The reminder was blunt: even official-looking accounts do not endorse specific memes. Treat surprise token posts as guilty until proven authentic.

The short version (for beginners)

Don’t trust viral posts—trust process. Any post that shares a contract address (CA) or “claim now” link can be faked.
Verify out of band: cross-check outside the post (official website, docs, GitHub, Discord/Telegram announcement channel, known explorers).
Never connect your main wallet to random sites. Use a fresh wallet with tiny funds when you must test.
Official channels rarely shill memes. If a post sounds promotional, assume it’s a hijack or impersonation until confirmed.

Why this is happening

Memecoins trade on attention and speed. Attackers know that traders will FOMO into brand-new tokens the moment a “big account” posts a contract address. By compromising verified handles—or making copycat accounts that look nearly identical—they can funnel users to drainer sites that request dangerous approvals (like unlimited spend) or push malicious signatures. It takes seconds to sign; it can take days to recover—if recovery is even possible.

5 red flags to spot instantly

1. Surprise token posts from an account that usually doesn’t announce tokens. “Official” tone, lots of emojis, urgent wording.

2. Brand-jacking: display name looks right, but the @handle has an extra character, or the account was created/renamed recently.

3. Force-you-to-connect flows: the page blocks content until you connect a wallet or sign a “permit/approve” message.

4. Too-good-to-be-true airdrops: guaranteed profits, “instant 10x”, countdown timers, or pay-to-claim mechanics.

5. Single-source contract address: the CA only exists in one post; you can’t find it on the project’s site or explorer links.

Do this before you click anything (30-second safety loop)

Check the handle, not the avatar. Click the profile. Is the @handle exact? When was the account created/renamed?
Find the official site via a known directory (docs, GitHub, verified Linktree). Does the site list the same contract?
Cross-verify on a block explorer: Is the contract verified? Who deployed it (multisig/known deployer) and when?
Search the project’s other channels (Discord announcements/Telegram/official blog). Is there a matching announcement?
If anything feels off, don’t connect. Wait for a second source or skip entirely.

Safe-use playbook (if you insist on trading memes)

Use a burner wallet with a small test amount; never connect your main vault.
Restrict approvals: set spend limits; avoid unlimited approvals on stablecoins/blue chips.
Hardware wallet + “read-only” mode in your portfolio trackers to reduce routine signing.
Slippage & MEV: set tight slippage; if liquidity is thin, assume price can gap hard.
Revoke regularly: use an approval-revoker after any experiment (especially on new chains).

Out-of-band verification: what counts as proof

Real projects tie all critical data together across channels. You should be able to match:

Website ↔ Docs ↔ Explorer (same CA, same deployer, same chain).
Social ↔ Blog/Announcements (matching timestamps, same wording, link back to the site).
Team multisig listed in docs and visible on the explorer (or an audit report naming it).

If a viral post is the only place showing a contract address, it’s not proof—it’s bait.

“I already clicked—what now?”

Disconnect the site and revoke approvals for the suspicious contract immediately.
Move assets from the affected wallet to a fresh wallet (new seed) if you signed anything sensitive.
Rotate keys (and change passwords/2FA) on any connected services.
Warn others in the project’s official channels so fewer people are hit.

Bottom line

Security starts with habits. Verify the source, perform an out-of-band check, and never click shady links or connect your wallet to random sites. Treat every viral token post as a potential trap until it’s independently confirmed by the project’s own, consistent, cross-linked channels. Hype is free—your coins aren’t.