# Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss

- Severity: Critical · Status: Partly contained (live)
- Chains: Solana · Method: Token account ownership change
- Started: Dec 5, 2025 · Last update: Oct 22, 2026 · Reported stolen: $3.0M · Victims: 1
- Who/what: Solana wallet user (single victim)

A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.

## Am I affected?
If you signed a transaction on an unfamiliar Solana tool or claim site that showed no balance change, and you now cannot revoke permissions or move tokens, check your wallet and token accounts on a Solana explorer. If the owner of an account is no longer your address, that account is under someone else's control.

## What to do now
Move anything still under your control to a brand-new wallet with a fresh seed phrase. Contact any DeFi protocols where you hold positions; in this case protocols helped recover about $2M. Report the attacker address to your wallet and to security firms.

## How to avoid this
A wallet preview that shows 'no balance change' is not proof a transaction is safe. Read the instruction list and reject anything that assigns, changes the owner of, or sets a new authority on your account or token accounts. Keep your wallet app updated so its owner-change warnings are active.

## Sources
- Beware of Solana Phishing Attacks: Wallet Owner Permissions Can Be Altered (SlowMist, 2025-12-05): https://x.com/SlowMist_Team/status/1996528328061382860
- OKX Wallet Warns of New Phishing Scam Targeting Solana Users (Coinfomania, 2026-01-07): https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/
- Solana User Loses $3M as Hidden Wallet Permissions Exploited (Coinpaper, 2025-12-05): https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited

Full record: https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025 · JSON: https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.