The Certificate of Analysis Named the Wrong Drug

We have written before about how to vet a peptide vendor. This summer produced a case study so specific that it is worth walking through on its own — because it exposes exactly which vendor signals are load-bearing and which are theater.

What the Investigations Found

In June and July 2026, CBS News published two investigations into the retatrutide supply chain. The findings were not subtle.

The first, in early June, identified more than 120 websites selling or promoting retatrutide and over 50 US clinics — staffed by licensed physicians and nurse practitioners — openly advertising a compound that is not approved anywhere in the world and cannot be legally compounded. At least 21 of those clinics removed retatrutide from their websites after reporters made contact.

The second, on July 2, found retatrutide being sold over the counter in Brooklyn convenience stores. A reporter purchased a vial for $95 with no prescription, no age verification, and no health questionnaire.

Meanwhile, America's Poison Centers recorded an average of 95 retatrutide-related exposure cases per month in the first four months of 2026 — a 265% increase over the last four months of 2025. Reported symptoms included vomiting, fainting, tachycardia and severe gastrointestinal distress.

The COA Failure

The most instructive detail is a documentation one.

Investigators examined a certificate of analysis published by a vendor called Indr Labs for its retatrutide. The certificate appeared to identify the sample as tirzepatide — a different peptide entirely.

When reporters contacted Vanguard Laboratory, the lab whose name appeared on the certificate, an operations manager told them: "We did not issue these, and we do not have a client called INDR Labs." Shortly afterward, Indr Labs password-protected its lab reports.

Sit with what that means. A buyer doing what the community universally recommends — "always check the COA" — would have seen a certificate, seen a lab name, and felt reassured. The document was the reassurance mechanism, and the document was the problem.

What a COA Can and Cannot Tell You

A certificate of analysis is only as trustworthy as the chain behind it. Three things have to be true, and a PDF on a vendor's website establishes none of them on its own:

1. The lab is real and actually ran the test. This is verifiable and almost nobody does it. Look up the laboratory independently — not through a link the vendor provides — and confirm it exists, does this kind of analysis, and will acknowledge the vendor as a client. In the Indr Labs case, one phone call was the whole investigation.

2. The certificate corresponds to the vial in your hand. A COA describes a specific batch. A single certificate reused across every lot, or one with no batch or lot number tying it to the product you received, tells you about a sample that existed once, somewhere, maybe.

3. The identity test actually confirms identity. Purity by HPLC answers "how much of this sample is one compound." It does not answer "which compound." Mass spectrometry addresses identity. A certificate reporting 99% purity with no identity confirmation is compatible with 99% pure something-you-did-not-order — which is the failure mode that surfaced here.

The Regulatory Picture Is Not Load-Bearing Either

The FDA has issued warning letters to retatrutide vendors since late 2024. According to a Public Citizen analysis, of fourteen recipients, eleven were still advertising the compound as of May 2026 and eight were still actively selling it. A warning letter is not an enforcement action with teeth attached, and vendors know it.

Separately — and this is a different problem worth not conflating — the FDA issued 25 warning letters to telehealth companies during the week of June 15, 2026, over marketing claims about compounded semaglutide and tirzepatide. The cited claims are a useful list of what is legally false: describing compounded drugs as "generic" versions of approved products, implying FDA approval or review, asserting clinical equivalence to the branded drug, and branding that implies the telehealth company manufactures the medication.

Note carefully what that action is and isn't. The FDA is targeting misleading marketing, not the practice of compounding. This is not a ban on compounded GLP-1s, and coverage saying otherwise is wrong.

What the Real-World Reports Look Like

A preprint analysis circulated this summer examined self-reported side effects among Reddit users taking unapproved retatrutide, identifying more than 13,000 users reporting current use. Its most interesting finding was divergence: the commonly reported real-world symptom pattern — appetite increase, fatigue, insomnia, elevated heart rate, food cravings — did not match the GI-dominant profile from the controlled trials.

Treat that carefully. It is a preprint, it is not peer-reviewed, and self-reported forum data carries obvious selection bias; the authors themselves frame it as hypothesis-generating. It is not incidence data and should never be quoted as such.

But the divergence itself is the signal worth noting. When people report a different side-effect profile than the trials found, one live explanation is that they are not all taking what the trials tested.

The Practical Checklist

• Verify the testing laboratory independently, through your own search, and confirm the vendor is actually a client.
• Require a batch or lot number on the certificate that matches your vial.
• Look for identity confirmation (mass spec), not purity alone.
• Treat a password-protected or suddenly-removed COA as a definitive answer, not an inconvenience.
• Remember that "research use only" is a labeling convention, not a legal protection or a quality standard. It confers nothing on the buyer.
• Understand that a licensed clinician prescribing something does not make it legal or vetted — over 50 US clinics were doing exactly that with retatrutide.

The Takeaway

The retatrutide gray market in 2026 is not a story about one bad vendor. It is a story about a verification system that people trust and that does not work: certificates that labs deny issuing, warning letters that vendors ignore, and clinics that quietly delete a product page when a reporter calls.

If you take one thing from this: the existence of a COA is not evidence of anything. Only a COA you can independently trace back to a real lab, tied to your specific batch, confirming identity rather than just purity, means something.

This article is for research and educational purposes only. It is not medical advice, and it does not endorse the purchase or use of any compound. Retatrutide is not approved for human use in any country and cannot be legally compounded in the United States.