Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps
Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)
Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.
Why this severity: Still active, many people exposed.
- Started
- Dec 26, 2025
- Chains
- Solana
- Method
- Bookmarklet drains
Indicators · never visit or send to these
- voltage[.]family
- D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6
What to do now
- Delete the bookmark.
- Move funds from the affected trading wallet to a fresh wallet.
- From a trusted device, log out of all sessions on the site, revoke sessions and turn on MFA.
- Check the email or Google account you log in with.
Stay safe
Am I affected?
You may be affected if you ever added a bookmark that someone else gave you (by dragging a button, icon or link to your bookmarks bar) and clicked it while logged in to a trading site or wallet. Look through your bookmarks bar for entries you did not make, especially ones with names like 'verify', 'checker' or 'click to verify'.
What to do now
- Delete the bookmark.
- Move funds from the affected trading wallet to a fresh wallet.
- From a trusted device, log out of all sessions on the site, revoke sessions and turn on MFA.
- Check the email or Google account you log in with.
How to avoid this
- Never drag or click a bookmark someone sends you, whether from a Telegram or Discord bot, a 'support' account, an 'alpha' group or a website.
- Real verification, CAPTCHAs and support never ask for this.
- Treat links on token pages and in group chats as untrusted.
- Keep trading wallets small and move profits out often.
Timeline 3
SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.
SourceSocket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.
SourceX users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.
Source
Alerts & on-chain evidence 1
News & write-ups ›3
- Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo UsersSlowMist · Oct 8, 2026
- Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet DataSocket · Sep 9, 2026
- Inside Calls on X: The 'Axiom Bookmark Method' warningX (@insidecalls) · Dec 26, 2025
How this method works
A fake verify bot or support account gets you to save a bookmark and click it on a trading site. The bookmark runs code inside your logged-in session and empties your wallet. Read about bookmarklet drains →
Follow new drains and updates in your feed reader or Telegram RSS bot.