Is Meteora safe? Audits, risks and history, checked

Three kinds of safety

“Is it safe?” has three parts. The code: can the pool programs be tricked into losing money? The tokens: is the token you're depositing or buying honest? The people: can you trust those who run and change the protocol? Each needs a different check.

The code: audits and the bug bounty

Meteora publishes audit reports for each program. The firms it lists include Offside Labs, Zenith, OtterSec, Sherlock, Sec3, Halborn, Oak and Quantstamp, and most reports cover a specific version of a program.^[1][8] It also runs a bug bounty through OOO Security, covering DLMM, DAMM v1 and v2, the bonding curve, Alpha Vault and its other programs.^[2]

Open-source code can be read by anyone; closed code can only be judged through audits.^[3] We found no exploit of a Meteora program in the sources we checked, including Helius's history of Solana hacks. That is not a promise that none will happen.^[7]

The tokens: the risk you carry

Creating a pool on Meteora needs no permission, so a pool existing says nothing about its token.^[4] Meteora shows a “Potential token risk” warning on suspicious tokens and points users to RugCheck, JupShield and Jupiter's Organic Score.^[9] Run the checks in How to check a token before you LP before every new token.

Where you trust people, not code

Some parts depend on people. You can give another address permission to manage your DLMM position, so only grant it to addresses you trust.^[10] The legacy Dynamic Vaults rely on an operator to move money between lending strategies.^[11] And the MET unlock schedule is a published promise: the vaults holding locked MET are ordinary wallets.^[12]

What happened in 2025

In January 2025, the TRUMP and MELANIA tokens launched in Meteora DLMM pools, which Meteora says drove record trading.^[13] On 14 February 2025, the LIBRA token, briefly promoted by Argentina's president, launched in a Meteora pool and lost more than 90% of its value within hours, Decrypt reported.^[14]

Meteora's co-founder and then-leader, Benjamin Chow, said the Meteora team was not involved in deploying LIBRA, making its market or deciding its launch.^[15] Two days later he said he had referred projects, including the MELANIA team, to Hayden Davis of Kelsier Ventures, and that Meteora had given LIBRA only technical support.^[16] On 17 February 2025, co-founder Meow announced that Chow had chosen to resign, said no one at Jupiter or Meteora had engaged in insider trading, and promised an independent investigation by the law firm Fenwick & West.^[5] We found no published report of that investigation.

A proposed class action, Hurlock v. Kelsier Ventures, was filed in New York state court in March 2025 and moved to federal court in May 2025. It names Meteora and Chow among the defendants and makes fraud and racketeering claims over the M3M3 and LIBRA tokens. These are allegations, not findings. In August 2025 the judge refused to keep the defendants' assets frozen, and Chow's lawyer called the claims untested and meritless.^[17] A company called Dynamic Labs Limited joined the case arguing that Meteora is software that can't be sued. Motions to dismiss were filed in September and October 2025, and in the latest court entries we read, from 18 September 2026, the case was still pending with no ruling on them.^[6]

Meteora later removed more than 100 addresses it linked to Kelsier from its reward points, and left pools of LIBRA, MELANIA and M3M3 out of its Season 2 rewards.^[18][19] Co-founder Zhen has led Meteora since March 2025, now as co-lead with Soju.^[20][13]

Other incidents

• 11 March 2025: someone briefly gained access to Meteora's X account; Meteora said it regained full control.^[21]
• Early 2026: Meteora disclosed losing $1.5 million of its treasury to a scammer while buying back MET over the counter, and said it had filed a police report. This was Meteora's own money, not users'.^[22]

How to protect yourself

• Type meteora.ag yourself. Meteora's team never messages you first or asks you to join another Discord.^[9]
• Never share your private key or recovery phrase with anyone, for any reason.^[9]
• Check every token before you deposit, and start with an amount you can afford to lose.
• Watch your positions: in DLMM, a price move can leave you holding only the weaker token.^[10]
• If your wallet is ever compromised, move what's left to a new wallet at once.^[9]