{
 "tag": "setauthority",
 "name": "Setauthority",
 "group": "Other",
 "incidents": [
  {
   "slug": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "title": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026",
   "json": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)",
   "tags": [
    "solana",
    "token-owner-swap",
    "spl-token",
    "setauthority",
    "false-top-up",
    "custody",
    "deposit-spoofing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-01",
   "closedAt": "2026-03-31",
   "updatedAt": "2026-03-31T12:00:00Z",
   "summary": "In February 2026 Liminal Custody's monitoring caught two low-value attempts that used SetAuthority to reassign an attacker's temporary SPL token account to a customer's deposit address after a net-zero transfer, so systems that look up owners through RPC could credit a deposit that never happened. Liminal says no erroneous credit occurred and no customer funds were affected. Exchanges, custodians and payment apps on Solana should verify the expected associated token account and real balance increases before crediting."
  },
  {
   "slug": "solana-owner-permission-phishing-3m-dec-2025",
   "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025",
   "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Solana wallet user (single victim)",
   "tags": [
    "solana",
    "token-owner-swap",
    "owner-permission",
    "assign",
    "setauthority",
    "simulation-blind-spot",
    "okx-wallet",
    "phantom",
    "slowmist",
    "signature-phishing",
    "account-takeover",
    "misttrack",
    "whale"
   ],
   "amountUsd": 3000000,
   "victims": 1,
   "startedAt": "2025-12-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T20:36:38.517Z",
   "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner."
  }
 ],
 "changes": [
  {
   "incident": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-31",
   "title": "Liminal publishes a write-up of the 'false top-up' technique and says it deployed instruction-level filtering and ATA validation.",
   "sourceUrl": "https://www.liminalcustody.com/?p=21280",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026"
  },
  {
   "incident": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-01",
   "title": "During February, Liminal Custody's SOC detects and neutralises two low-value SPL token-account ownership reassignment attempts (exact days not published).",
   "sourceUrl": "https://www.liminalcustody.com/?p=21280",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  }
 ]
}