{
 "slug": "solana-owner-permission-phishing-3m-dec-2025",
 "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
 "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025",
 "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "solana"
 ],
 "method": "token-owner-swap",
 "product": "Solana wallet user (single victim)",
 "tags": [
  "solana",
  "token-owner-swap",
  "owner-permission",
  "assign",
  "setauthority",
  "simulation-blind-spot",
  "okx-wallet",
  "phantom",
  "slowmist",
  "signature-phishing",
  "account-takeover",
  "misttrack",
  "whale"
 ],
 "amountUsd": 3000000,
 "victims": 1,
 "startedAt": "2025-12-05",
 "closedAt": null,
 "updatedAt": "2026-10-22T20:36:38.517Z",
 "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.",
 "timeline": [
  {
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860"
  },
  {
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited"
  },
  {
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "Beware of Solana Phishing Attacks: Wallet Owner Permissions Can Be Altered",
   "url": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "publisher": "SlowMist",
   "date": "2025-12-05"
  },
  {
   "kind": "news",
   "title": "OKX Wallet Warns of New Phishing Scam Targeting Solana Users",
   "url": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "publisher": "Coinfomania",
   "date": "2026-01-07"
  },
  {
   "kind": "news",
   "title": "Solana User Loses $3M as Hidden Wallet Permissions Exploited",
   "url": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "publisher": "Coinpaper",
   "date": "2025-12-05"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you signed a transaction on an unfamiliar Solana tool or claim site that showed no balance change, and you now cannot revoke permissions or move tokens, check your wallet and token accounts on a Solana explorer. If the owner of an account is no longer your address, that account is under someone else's control.\n\n## What to do now\nMove anything still under your control to a brand-new wallet with a fresh seed phrase. Contact any DeFi protocols where you hold positions; in this case protocols helped recover about $2M. Report the attacker address to your wallet and to security firms.\n\n## How to avoid this\nA wallet preview that shows 'no balance change' is not proof a transaction is safe. Read the instruction list and reject anything that assigns, changes the owner of, or sets a new authority on your account or token accounts. Keep your wallet app updated so its owner-change warnings are active.",
 "notes": null,
 "agentBrief": "# Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss\n\n- Severity: Critical · Status: Partly contained (live)\n- Chains: Solana · Method: Token account ownership change\n- Started: Dec 5, 2025 · Last update: Oct 22, 2026 · Reported stolen: $3.0M · Victims: 1\n- Who/what: Solana wallet user (single victim)\n\nA Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.\n\n## Am I affected?\nIf you signed a transaction on an unfamiliar Solana tool or claim site that showed no balance change, and you now cannot revoke permissions or move tokens, check your wallet and token accounts on a Solana explorer. If the owner of an account is no longer your address, that account is under someone else's control.\n\n## What to do now\nMove anything still under your control to a brand-new wallet with a fresh seed phrase. Contact any DeFi protocols where you hold positions; in this case protocols helped recover about $2M. Report the attacker address to your wallet and to security firms.\n\n## How to avoid this\nA wallet preview that shows 'no balance change' is not proof a transaction is safe. Read the instruction list and reject anything that assigns, changes the owner of, or sets a new authority on your account or token accounts. Keep your wallet app updated so its owner-change warnings are active.\n\n## Sources\n- Beware of Solana Phishing Attacks: Wallet Owner Permissions Can Be Altered (SlowMist, 2025-12-05): https://x.com/SlowMist_Team/status/1996528328061382860\n- OKX Wallet Warns of New Phishing Scam Targeting Solana Users (Coinfomania, 2026-01-07): https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/\n- Solana User Loses $3M as Hidden Wallet Permissions Exploited (Coinpaper, 2025-12-05): https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited\n\nFull record: https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025 · JSON: https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}