# Phantom · Drain Watch

3 incidents, 3 live. JSON: https://drains.watch/t/phantom.json · RSS: https://drains.watch/t/phantom/feed.xml

- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026) (live, High, Partly contained, since Feb 5, 2026)
- [Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss](https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025) (live, Critical, Partly contained, since Dec 5, 2025)
- [Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses](https://drains.watch/i/solana-address-poisoning-wave-2025-2026) (live, Critical, Still active, since Nov 17, 2025)