Bookmarklet drains
A fake verify bot or support account gets you to save a bookmark and click it on a trading site. The bookmark runs code inside your logged-in session and empties your wallet.
How it works
It starts in a Telegram or Discord group, a DM from fake support, or an alpha or whitelist offer. You are told to verify, claim or unlock something.
The steps ask you to drag a link to your bookmarks bar, or make a bookmark and paste some text into it. That text is code, not a web address.
You are then told to open your trading terminal or wallet site and click the bookmark. It runs as if it were part of that site, with your login, so it can read your session, sign with or export your keys, and send your funds out.
Nothing looks wrong, and often no wallet pop-up appears, because the site's own built-in wallet does the signing.
Red flags
- Anyone asking you to drag, save or click a bookmark to verify, claim or fix something
- A bookmark or link that starts with javascript:
- A verification step that only works while you are logged in to a trading site
- Pressure: a mint, airdrop or whitelist that closes in minutes
Protect yourself
- Never add or click a bookmark someone else gave you. Real verification never needs one
- Check your bookmarks bar and delete anything you don't recognise, especially entries starting with javascript:
- Keep only small amounts in trading-terminal wallets and move profits to a wallet you control
- Turn on any withdrawal or key-export protection your trading platform offers
If you already signed
- Log out of the trading site everywhere and end all other sessions
- Move what is left to a fresh wallet, and treat the terminal wallet's key as stolen
- Delete the bookmark and warn the group admins and the platform's support
- Report the attacker's address
Incidents using it 3
-
Medium✕Still active
Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet
A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.
Fomo web app users (Privy embedded wallets)·Solana·$48K stolen·Since Oct 8, 2026·
-
High✕Still active
Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps
Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.
Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)·Solana·Since Dec 26, 2025·
-
Medium✕Still active? Unverified
'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K
In late December 2025, X users warned that scammers were luring Axiom traders with fake tools such as token checkers and getting them to drag a bookmark into the browser, which ran on the logged-in Axiom page and gave the scammer access to the victim's funds. An X trending summary headlined the scam as draining over $200,000, and one widely viewed warning post said a person the author knew had recently fallen for it and asked Axiom to patch it. No security firm, news outlet or Axiom statement confirming the amount was found. Axiom users should never run a bookmark someone gives them and should move funds if they did.
Axiom trading terminal users·Solana·Since Dec 26, 2025·