Dec 5, 2025
1 new drain.
New
-
Critical◐Partly contained
Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss
A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.
Solana wallet user (single victim)·Solana·$3.0M stolen·Since Dec 5, 2025·