Token account ownership change
A Solana transaction quietly hands ownership of your token accounts (or your whole account) to the attacker, so the tokens are no longer yours to move.
How it works
On Solana, tokens sit in token accounts with an owner. The token program can reassign that owner, and accounts can be reassigned to another program. These are normal tools for programs, but they shouldn't appear in a casual claim or swap.
Drainers slip an ownership change into a transaction presented as a claim or a mint. Nothing seems to leave your wallet at first, and some wallets show no balance change in the preview, but the attacker now controls those accounts and empties them.
Because the balance looks untouched for a moment, victims often don't notice until it's gone.
Red flags
- A wallet warning about an owner change, SetAuthority or account reassignment
- Claim sites that need you to sign several transactions in a row
- Previews that show 'no changes' for a transaction that's supposed to give you something
Protect yourself
- Use a wallet that simulates transactions and warns about ownership changes (Phantom, Solflare, Backpack all do)
- Never override a wallet's red warning to 'make the claim work'
- Keep valuable tokens in a wallet that never connects to claim sites
If you already signed
- Check your token accounts on a block explorer for a new owner
- Move anything still under your control to a fresh wallet
- Report the site to your wallet's security team
Incidents using it 2
-
Low✓Contained
SPL token-account ownership reassignment used to fake deposits at a Solana custodian
In February 2026 Liminal Custody's monitoring caught two low-value attempts that used SetAuthority to reassign an attacker's temporary SPL token account to a customer's deposit address after a net-zero transfer, so systems that look up owners through RPC could credit a deposit that never happened. Liminal says no erroneous credit occurred and no customer funds were affected. Exchanges, custodians and payment apps on Solana should verify the expected associated token account and real balance increases before crediting.
Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)·Solana·Since Feb 1, 2026·
-
Critical◐Partly contained
Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss
A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.
Solana wallet user (single victim)·Solana·$3.0M stolen·Since Dec 5, 2025·