Skills
1 incident, 1 live. 259 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
Live
-
Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys
Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.
OpenClaw (ClawHub) skill users·Solana, Multiple EVM chains·Since Feb 5, 2026·
No drains match these filters.