Solana
27 incidents, 9 live. 13 days since the last new one.
26 drains in the last 12 months
26 drains in the last 12 months
19 drains in 2026
8 drains in 2025
Live
-
Critical◐Partly contained
Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M
Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.
Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers·Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin·$102M stolen·Since Oct 9, 2026·
-
Medium✕Still active
Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet
A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.
Fomo web app users (Privy embedded wallets)·Solana·$48K stolen·Since Oct 8, 2026·
-
High◐Partly contained
19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons
Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available.
Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'·Multiple EVM chains, Solana, Tron·Since Aug 30, 2026·
-
Critical◐Partly contained
Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON
On Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates.
Triple-A payment processor hot wallets·Solana, Ethereum, Tron·$9.7M stolen·Since Jul 24, 2026·
-
Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions
On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk.
Drift Protocol (Security Council multisig)·Solana·$285M stolen·Since Apr 1, 2026·
-
Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys
Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.
OpenClaw (ClawHub) skill users·Solana, Multiple EVM chains·Since Feb 5, 2026·
-
High✕Still active
Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps
Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.
Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)·Solana·Since Dec 26, 2025·
-
Critical◐Partly contained
Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss
A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.
Solana wallet user (single victim)·Solana·$3.0M stolen·Since Dec 5, 2025·
-
Critical✕Still active
Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses
Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history.
Solana wallet users sending to exchange deposit addresses·Solana·$940K stolen·Since Nov 17, 2025·
Past
September 2026 1
-
Critical✓Contained
Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise
On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe.
Duelbits crypto casino hot wallets·Ethereum, BNB Chain, Tron, Bitcoin, Solana·$7.0M stolen·Since Sep 24, 2026·
June 2026 1
-
Medium✕Still active
'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses
McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published.
Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)·Bitcoin, Ethereum, Solana·Since Jun 30, 2026·
May 2026 2
-
Critical✕Still active
'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included
Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet.
Seed phrases made by some less widely used mobile software wallets (2018 onward)·Solana, Bitcoin, Ethereum, Polygon, Tron·$5.0M stolen·Since May 27, 2026·
-
Medium✕Still active
Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites
In May 2026, Solana Floor warned that scammers were sending counterfeit '$CJUP' tokens to Solana wallets while impersonating Jupiter's Jupuary airdrop. The tokens point holders to phishing 'claim' sites that drain any wallet that connects. Losses were not quantified. Jupiter had not announced a new airdrop at the time, and its only official site is jup[.]ag. If a token you never bought appears with a claim link, ignore it.
Jupiter (JUP) community and Solana wallet users·Solana·Since May 22, 2026·
April 2026 1
-
Critical◐Partly contained
Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts
A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase.
Ledger users who installed 'Ledger Live' from the Mac App Store·Bitcoin, Ethereum, Tron, Solana·$9.5M stolen·Since Apr 8, 2026·
March 2026 3
-
Solana wallet MCP server on PyPI sent users' private keys to a remote server
An advisory published on 31 March 2026 flagged latinum-wallet-mcp, a PyPI package that runs a Solana wallet as an MCP server for AI agents, as malicious. From version 0.0.32 it sent the wallet's private key, along with other metrics, to a remote server during wallet setup, and from 0.0.34 it added itself as an MCP server for Claude on import; none of this was in the public GitHub code. Versions 0.0.32 to 0.0.36 are listed as affected. Anyone who installed them should treat that Solana key as stolen and move funds to a new wallet.
latinum-wallet-mcp (PyPI)·Solana·Since Mar 31, 2026·
-
Medium◐Partly contained
Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys
In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.
npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd·Solana, Ethereum·Since Mar 26, 2026·
-
High◐Partly contained
Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt
On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet.
Bonk.fun launchpad users·Solana·$30K stolen·Since Mar 11, 2026·
February 2026 3
-
Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent
ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines.
AI trading agent projects and Web3 developers on npm·Solana·Since Feb 28, 2026·
-
AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL
On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval.
Lobstar Wilde, an experimental AI trading agent on X·Solana·$250K stolen·Since Feb 22, 2026·
-
Low✓Contained
SPL token-account ownership reassignment used to fake deposits at a Solana custodian
In February 2026 Liminal Custody's monitoring caught two low-value attempts that used SetAuthority to reassign an attacker's temporary SPL token account to a customer's deposit address after a net-zero transfer, so systems that look up owners through RPC could credit a deposit that never happened. Liminal says no erroneous credit occurred and no customer funds were affected. Exchanges, custodians and payment apps on Solana should verify the expected associated token account and real balance increases before crediting.
Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)·Solana·Since Feb 1, 2026·
January 2026 2
-
Critical✓Contained
Step Finance treasury wallets drained of about $40M; Solana platform later shuts down
On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption.
Step Finance treasury and fee wallets·Solana·$40M stolen·Since Jan 31, 2026·
-
Critical✓Contained
Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam
On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel.
Meteora treasury (OTC buyback of MET)·Solana·$1.5M stolen·Since Jan 17, 2026·
December 2025 2
-
Medium✕Still active? Unverified
'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K
In late December 2025, X users warned that scammers were luring Axiom traders with fake tools such as token checkers and getting them to drag a bookmark into the browser, which ran on the logged-in Axiom page and gave the scammer access to the victim's funds. An X trending summary headlined the scam as draining over $200,000, and one widely viewed warning post said a person the author knew had recently fallen for it and asked Axiom to patch it. No security firm, news outlet or Axiom statement confirming the amount was found. Axiom users should never run a bookmark someone gives them and should move funds if they did.
Axiom trading terminal users·Solana·Since Dec 26, 2025·
-
Critical✓Contained
Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets
A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.
Trust Wallet Chrome extension v2.68·Solana, Bitcoin, Ethereum·$8.5M stolen·Since Dec 24, 2025·
November 2025 2
-
Critical✓Contained
Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected
On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing.
Upbit exchange Solana hot wallet·Solana·$36M stolen·Since Nov 27, 2025·
-
High✓Contained
DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana
SlowMist's hack database lists a $130,000 phishing loss on Nov 20, 2025, filed under Solana, tied to the DMT token airdrop promoted by the X account @dexmaxai. The airdrop claim was the lure for the phishing. If you claimed DMT, check your wallet for token delegations or unexpected outgoing transfers and move what is left to a new wallet.
DMT airdrop claimants (@dexmaxai)·Solana·$130K stolen·Since Nov 20, 2025·
July 2025 1
-
AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads
On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published.
npm package @kodane/patch-manager·Solana·Since Jul 28, 2025·
No drains match these filters.