# Claude · Drain Watch

3 incidents, 0 live. JSON: https://drains.watch/t/claude.json · RSS: https://drains.watch/t/claude/feed.xml

- [Solana wallet MCP server on PyPI sent users' private keys to a remote server](https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026) (closed, Medium, Partly contained, since Mar 31, 2026)
- [Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent](https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026) (closed, Medium, Still active, since Feb 28, 2026)
- [AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads](https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025) (closed, High, Contained, since Jul 28, 2025)