Phantom

Live

• High◐Partly containedAI · Agent target

  Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys

  Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.

  OpenClaw (ClawHub) skill users·Solana, Multiple EVM chains·Since Feb 5, 2026·updated 1 min ago

• Critical◐Partly contained

  Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss

  A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.

  Solana wallet user (single victim)·Solana·$3.0M stolen·Since Dec 5, 2025·updated 1h ago

• Critical✕Still active

  Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses

  Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history.

  Solana wallet users sending to exchange deposit addresses·Solana·$940K stolen·Since Nov 17, 2025·updated 10 days ago

No drains match these filters.