SPL token-account ownership reassignment used to fake deposits at a Solana custodian
Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)
In February 2026 Liminal Custody's monitoring caught two low-value attempts that used SetAuthority to reassign an attacker's temporary SPL token account to a customer's deposit address after a net-zero transfer, so systems that look up owners through RPC could credit a deposit that never happened. Liminal says no erroneous credit occurred and no customer funds were affected. Exchanges, custodians and payment apps on Solana should verify the expected associated token account and real balance increases before crediting.
Why this severity: A warning with little reported loss.
- Started
- Feb 1, 2026
- Closed
- Mar 31, 2026
- Chains
- Solana
At risk
- Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)
- Solana wallets
What to do now
- Review recent deposits where a SetAuthority instruction touched an account that also appeared in a transfer, and check that each credited token account is the expected associated token account for the user and mint.
Stay safe
Am I affected?
This targets services that credit Solana token deposits (exchanges, custodians, payment apps), not ordinary wallet users. If your service decides who owns a token account by asking an RPC node for its current owner, it may be exposed.
What to do now
Review recent deposits where a SetAuthority instruction touched an account that also appeared in a transfer, and check that each credited token account is the expected associated token account for the user and mint.
How to avoid this
Parse every instruction before crediting, recompute the expected associated token account address instead of trusting RPC owner data, credit only on a verified net balance increase, and delay credits for new or unverified deposit addresses.
Timeline 2
News & write-ups ›1
How this method works
A Solana transaction quietly hands ownership of your token accounts (or your whole account) to the attacker, so the tokens are no longer yours to move. Read about token account ownership change →
Follow new drains and updates in your feed reader or Telegram RSS bot.