Bookmarklet drains
3 incidents, 2 live. 14 days since the last new one.
3 drains in the last 12 months
3 drains in the last 12 months
1 drains in 2026
2 drains in 2025
Live
-
Medium✕Still active
Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet
A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.
Fomo web app users (Privy embedded wallets)·Solana·$48K stolen·Since Oct 8, 2026·
-
High✕Still active
Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps
Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.
Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)·Solana·Since Dec 26, 2025·
Past
December 2025 1
-
Medium✕Still active? Unverified
'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K
In late December 2025, X users warned that scammers were luring Axiom traders with fake tools such as token checkers and getting them to drag a bookmark into the browser, which ran on the logged-in Axiom page and gave the scammer access to the victim's funds. An X trending summary headlined the scam as draining over $200,000, and one widely viewed warning post said a person the author knew had recently fallen for it and asked Axiom to patch it. No security firm, news outlet or Axiom statement confirming the amount was found. Axiom users should never run a bookmark someone gives them and should move funds if they did.
Axiom trading terminal users·Solana·Since Dec 26, 2025·
No drains match these filters.