Hackers who took control of McDonald’s official Instagram account on August 21 managed to steal over $700,000 in Solana by promoting and then abruptly abandoning a fraudulent memecoin called “Grimace.”
Screenshots shared on X (formerly Twitter) revealed that the fast food giant's Instagram account posted multiple messages endorsing a bogus token themed around Grimace, the chain's well-known purple mascot.
Several posts claimed the memecoin was part of a “McDonald’s experiment on Solana,” reaching the platform's 5.1 million followers worldwide.
Blockchain analytics service Bubblemaps reported that the hacker used Solana memecoin deployer pump.fun to acquire 75% of the Grimace token's total circulating supply, which was then divided among approximately 100 different wallets.
DexScreener data showed that following the posts from McDonald’s account, the market capitalization of GRIMACE surged from just a few thousand dollars to a staggering $25 million within 30 minutes. However, the token’s value nosedived as the hacker quickly offloaded their holdings, plummeting to as low as $650,000 within 40 minutes.
Bubblemaps confirmed that the hackers ultimately made a profit of about $700,000 in Solana (SOL) from the scam. The hacker even edited McDonald’s Instagram bio to boast about the successful heist, stating, “Sorry mah n-gga you have just been rug pulled by India_X_Kr3w thank you for the $700,000 in Solana.”
The fraudulent posts and bio have since been removed, and the account has returned to normal.
McDonald’s acknowledged the breach in a statement to the New York Post, describing it as an “isolated incident” that affected its social media accounts on August 21. “We have resolved the issue on those accounts and apologize to our fans for any offensive language posted during that time,” McDonald’s said.
