On October 29, 2026 at 7:42 UTC, 92.7 million OZA tokens were withdrawn from two Solsale lock vaults, GemPad’s Solana launchpad, and then sold a minute later for 185.76 SOL, or approximately $18,000. The two positions, which expire on April 8, 2027, belong to the founder of Ozapay, Johan Decottignies; the withdrawal was signed by an address that is not the owner. Tremplin.io verified these transactions on the blockchain. The price of the French fintech’s token fell to almost zero, the lock program was updated the next day, and GemPad still has not reacted.
In brief
- On October 29, 2026, 92.7 million OZA tokens were withdrawn from two Solsale locks, five months before they expired.
- The tokens were resold a minute later for around $18,000, causing OZA’s price to collapse.
- The transactions were confirmed on the blockchain, but the origin of the unauthorized withdrawals remains unknown.
- The lockout program was changed the very next day, while GemPad and Solsale provided no public explanation.
- The founder of Ozapay filed a complaint and estimates his theoretical damage at $3.77 million.
A lock broken five months before the deadline
On October 29, Johan Decottignies announced on the Ozapay website And on LinkedIn that “92.7 million OZA tokens, personally owned by the founder and voluntarily locked until April 8, 2027” were removed without his authorization and then resold. In a response to Tremplin.io on November 2, he clarified that the tokens came from two lock positions, that a complaint against X was filed and that the French authorities were informed. He transmits the signature of the sales transaction.
The channel confirms its story, and clarifies it. At 07:42:15 UTC, an address beginning with FsHbb signs the withdrawal of 90 million OZA of G7agib accountthen that of 2.7 million from a second account; both are accounts derived from the lock program HMPEqW77the one that Ozapay has used since March 2025. At 7:43:19 a.m., the same address exchanges the 92.7 million tokens for 185.76 WSOL via the OKX DEX router, on two Raydium pools. At the SOL price that day, just under $100, the sale brought in about $18,000. The product was distributed over the following hours to several addresses, in increments of 100 and 159 SOL.
On the Solsale interfaceboth positions are still shown as locked as of November 5, with “ 154 days remaining ». The lock details show an owner starting with 3PDHJ for the position “Team Ozapay” of 90 million, placed on January 8, 2026, and another owner for the Founder Lock of 2.7 million, placed on June 19, 2025, both maturing on April 8, 2027. Neither corresponds to the address which signed the withdrawals. The coffers are empty.
A modified program the next day, a silent operator
THE program HMPEqW77 is not verified on Solscan, does not publish a security.txt file and remains editable by its update authority. On October 29, the FsHbb address issued dozens of withdrawal instructions against this program, and the wallet liquidated other tokens than OZA on the same day. On October 30, the program was extended and then updated by its upgrade authority. Ozapay, who says he noted suspicious movements on “115 projects and 301 lock positions”presents this figure as a scope to be confirmed, not as proof.
GemPad and Solsale have not published any press release and have not responded to the founder, who says he also contacted Phantom, whose application catalog references Solsale, without response. From his own Telegram account, he sees the GemPad group as inaccessible; the public channel @TheGemPad remains searchable, with more than 9,700 members. No monitoring company has reported an exploit, while Solana is among the most targeted networks in 2026. The precedent does exist: on December 17, 2024, the GemPad lock contract on Ethereum, BNB Chain and Base had been emptied from 1.8 to 2.2 million dollars by a re-entrance attack, documented by Decuritydespite audits; 27 projects were affected and GemPad recognized the flaw the same day. The Solsale interface now displays a banner “SECURE” referring to audits from January 2025.
What the chain does not say is how the FsHbb address was able to execute these withdrawals: program flaw, key compromise or other scenario. The wallet has been active since February 2025, has over a thousand transfers and had never held OZA before October 29. Its owner is not identified. Ozapay says it has “a technical lead concerning the alleged person responsible”, reserved for the procedure. As for the movement of October 27, two days before, where the price was halved during the session, the company attributes it to the sale of the assets of a community investor, unrelated to the locks.
Market, harm and OZA V2
On Raydium, the main pair OZA/SOL had a price of $0.000002857 on November 2, a liquidity of $307 and a diluted capitalization of $2,849, according to DexScreeneragainst a price close to $0.04 at the end of October and a diluted capitalization of around $40 million according to ChallengeLlama And CoinGecko. The founder estimates his loss at $3.77 million at a price of $0.04067 recorded before the incident, while recognizing that this is a theoretical value: with a few hundred dollars of daily volume, the market could never have absorbed such a quantity. The $18,000 actually earned from the sale shows this.
Ozapay announces an OZA V2 token to the Solana Token-2022 standard, which allows transfer and locking rules to be natively integrated into the token itself, with a fixed issue of one billion units, the end of any dependence on an external locker and an independent audit before deployment. The migration would be based on a snapshot prior to October 29, at parity of 1 OZA V1 for 1 OZA V2, with maintenance of the initial locking periods, financed by the founder from his personal resources with the support of independent investors. A listing is being studied on Orca or Meteora, then on an unnamed centralized platform, without date. The founder specifies that the migration “does not constitute a guarantee of reimbursement in euros”.
No assets held in Ozapay app users’ wallets were affected. Holders are invited to keep their OZA V1 and their supporting documents, and to be wary of false migration pages: only announcements from official Ozapay channels are authentic. Tremplin.io published sponsored content for the Ozapay IDO in May 2025. This article is based on public data verified by the editorial staff and on Ozapay’s statements, attributed as such; it does not constitute investment advice, and the OZA token presents a risk of total loss.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
