{ "tag": "solana", "name": "Solana", "group": "Chains", "incidents": [ { "slug": "ledger-cryptobilis-tampered-hardware-wallets", "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets", "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "tron", "ethereum", "bsc", "polygon", "solana", "bitcoin" ], "method": "supply-chain", "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers", "tags": [ "tron", "ethereum", "bsc", "polygon", "solana", "bitcoin", "supply-chain", "ledger", "hardware-wallet", "cryptobilis", "reseller", "hardware-implant", "seed-phrase-theft", "tether-freeze" ], "amountUsd": 102000000, "victims": 324, "startedAt": "2026-10-09", "closedAt": null, "updatedAt": "2026-10-16T12:00:00Z", "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct." }, { "slug": "fomo-bookmarklet-fake-verification-oct-2026", "title": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet", "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026", "json": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json", "status": "live", "severity": "medium", "threatStatus": "active", "verification": "verified", "chains": [ "solana" ], "method": "bookmarklet", "product": "Fomo web app users (Privy embedded wallets)", "tags": [ "solana", "bookmarklet", "fomo", "privy", "embedded-wallet", "session-hijack", "fake-captcha", "fake-verification", "token-page-link", "slowmist", "privacy-cash" ], "amountUsd": 48000, "victims": 1, "startedAt": "2026-10-08", "closedAt": null, "updatedAt": "2026-10-08T12:00:00Z", "summary": "A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds." }, { "slug": "duelbits-hot-wallet-drain-sep-2026", "title": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026", "json": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum", "bsc", "tron", "bitcoin", "solana" ], "method": "key-leak", "product": "Duelbits crypto casino hot wallets", "tags": [ "ethereum", "bsc", "tron", "bitcoin", "solana", "key-leak", "casino", "gambling", "hot-wallet", "private-key-compromise", "duelbits" ], "amountUsd": 7000000, "victims": null, "startedAt": "2026-09-24", "closedAt": "2026-09-27", "updatedAt": "2026-10-06T12:00:00Z", "summary": "On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe." }, { "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026", "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons", "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026", "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json", "status": "live", "severity": "high", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "multi-evm", "solana", "tron" ], "method": "malicious-extension", "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'", "tags": [ "multi-evm", "solana", "tron", "malicious-extension", "chrome", "edge", "browser-extension", "extension-takeover", "seed-phishing", "clickfix", "ledger", "trezor", "metamask", "socket" ], "amountUsd": null, "victims": null, "startedAt": "2026-08-30", "closedAt": null, "updatedAt": "2026-08-30T12:00:00Z", "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available." }, { "slug": "triple-a-hot-wallets-drained-jul-2026", "title": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON", "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026", "json": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "solana", "ethereum", "tron" ], "method": null, "product": "Triple-A payment processor hot wallets", "tags": [ "solana", "ethereum", "tron", "payments", "hot-wallet", "treasury", "triple-a", "multi-chain", "peckshield" ], "amountUsd": 9700000, "victims": null, "startedAt": "2026-07-24", "closedAt": null, "updatedAt": "2026-07-25T12:00:00Z", "summary": "On Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates." }, { "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026", "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses", "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026", "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "chains": [ "bitcoin", "ethereum", "solana" ], "method": "clipboard-hijacker", "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)", "tags": [ "bitcoin", "ethereum", "solana", "clipboard-hijacker", "clipper", "browser-extension", "chrome", "chromium", "countloader", "mcafee", "etherhiding", "windows" ], "amountUsd": null, "victims": null, "startedAt": "2026-06-30", "closedAt": "2026-06-30", "updatedAt": "2026-06-30T12:00:00Z", "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published." }, { "slug": "ill-bloom-weak-seed-randomness-drains-may-2026", "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026", "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "solana", "bitcoin", "ethereum", "polygon", "tron" ], "method": "key-leak", "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)", "tags": [ "solana", "bitcoin", "ethereum", "polygon", "tron", "key-leak", "weak-randomness", "prng", "seed-phrase", "mobile-wallet", "coinspect", "ill-bloom" ], "amountUsd": 5000000, "victims": 431, "startedAt": "2026-05-27", "closedAt": "2026-07-06", "updatedAt": "2026-07-06T12:00:00Z", "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet." }, { "slug": "fake-cjup-jupiter-airdrop-drainer-may-2026", "title": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites", "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026", "json": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "chains": [ "solana" ], "method": "fake-airdrop-site", "product": "Jupiter (JUP) community and Solana wallet users", "tags": [ "solana", "fake-airdrop-site", "jupiter", "jup", "jupuary", "airdrop", "spam-token", "impersonation", "solana-floor" ], "amountUsd": null, "victims": null, "startedAt": "2026-05-22", "closedAt": "2026-05-22", "updatedAt": "2026-05-22T12:00:00Z", "summary": "In May 2026, Solana Floor warned that scammers were sending counterfeit '$CJUP' tokens to Solana wallets while impersonating Jupiter's Jupuary airdrop. The tokens point holders to phishing 'claim' sites that drain any wallet that connects. Losses were not quantified. Jupiter had not announced a new airdrop at the time, and its only official site is jup[.]ag. If a token you never bought appears with a claim link, ignore it." }, { "slug": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "title": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026", "json": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "bitcoin", "ethereum", "tron", "solana" ], "method": "fake-app", "product": "Ledger users who installed 'Ledger Live' from the Mac App Store", "tags": [ "bitcoin", "ethereum", "tron", "solana", "fake-app", "ledger", "app-store", "macos", "apple", "seed-phrase", "zachxbt", "kucoin" ], "amountUsd": 9500000, "victims": 50, "startedAt": "2026-04-08", "closedAt": "2026-04-15", "updatedAt": "2026-04-15T12:00:00Z", "summary": "A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase." }, { "slug": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "title": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026", "json": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026.json", "status": "live", "severity": "critical", "threatStatus": "contained", "verification": "verified", "ai": { "role": "agent-attack", "note": "TRM Labs investigator Nick Carlsen, a former FBI analyst, assessed it highly likely that the attackers used AI to pick targets and design the exploit, as The Next Web reported citing Bloomberg; this is an expert assessment, not confirmed." }, "chains": [ "solana" ], "method": "durable-nonce", "product": "Drift Protocol (Security Council multisig)", "tags": [ "solana", "durable-nonce", "drift", "multisig", "security-council", "social-engineering", "admin-takeover", "cctp", "wormhole", "admin-key", "dprk", "tornado-cash", "laundering", "ai" ], "amountUsd": 285000000, "victims": null, "startedAt": "2026-04-01", "closedAt": "2026-04-01", "updatedAt": "2026-10-22T21:53:35.016Z", "summary": "On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk." }, { "slug": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026", "title": "Solana wallet MCP server on PyPI sent users' private keys to a remote server", "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026", "json": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026.json", "status": "closed", "severity": "medium", "threatStatus": "partly-contained", "verification": "verified", "ai": { "role": "agent-target", "note": "The package was an MCP wallet server for AI agents; it auto-registered itself as an MCP server for Claude and sent the Solana private key to a remote server." }, "chains": [ "solana" ], "method": "supply-chain", "product": "latinum-wallet-mcp (PyPI)", "tags": [ "solana", "supply-chain", "mcp", "mcp-server", "pypi", "claude", "ai-agent", "private-key", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-03-31", "closedAt": "2026-03-31", "updatedAt": "2026-03-31T12:00:00Z", "summary": "An advisory published on 31 March 2026 flagged latinum-wallet-mcp, a PyPI package that runs a Solana wallet as an MCP server for AI agents, as malicious. From version 0.0.32 it sent the wallet's private key, along with other metrics, to a remote server during wallet setup, and from 0.0.34 it added itself as an MCP server for Claude on import; none of this was in the public GitHub code. Versions 0.0.32 to 0.0.36 are listed as affected. Anyone who installed them should treat that Solana key as stolen and move funds to a new wallet." }, { "slug": "npm-galedonovan-solana-key-stealers-mar-2026", "title": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys", "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026", "json": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json", "status": "closed", "severity": "medium", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "solana", "ethereum" ], "method": "supply-chain", "product": "npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd", "tags": [ "solana", "ethereum", "supply-chain", "npm", "typosquat", "bs58", "base58", "telegram-c2", "developers", "raydium" ], "amountUsd": null, "victims": null, "startedAt": "2026-03-26", "closedAt": "2026-03-26", "updatedAt": "2026-03-26T12:00:00Z", "summary": "In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds." }, { "slug": "bonk-fun-domain-hijack-drainer-mar-2026", "title": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt", "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026", "json": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json", "status": "closed", "severity": "high", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "solana" ], "method": "front-end-hijack", "product": "Bonk.fun launchpad users", "tags": [ "solana", "front-end-hijack", "bonk-fun", "launchpad", "domain-hijack", "fake-tos", "signature-phishing", "bonk" ], "amountUsd": 30000, "victims": null, "startedAt": "2026-03-11", "closedAt": "2026-03-12", "updatedAt": "2026-03-12T12:00:00Z", "summary": "On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet." }, { "slug": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026", "title": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent", "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026", "json": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "agent-target", "note": "The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents." }, "chains": [ "solana" ], "method": "supply-chain", "product": "AI trading agent projects and Web3 developers on npm", "tags": [ "solana", "supply-chain", "npm", "pypi", "ai-coding-agent", "claude", "ai-trading-bot", "famous-chollima", "north-korea", "dprk", "promptmink", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-02-28", "closedAt": "2026-04-29", "updatedAt": "2026-04-29T12:00:00Z", "summary": "ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines." }, { "slug": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "title": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL", "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "json": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "ai": { "role": "agent-target", "note": "The autonomous AI agent acted on an X reply asking it for 4 SOL and sent about 53 million tokens instead; the bot called it an accident, and the decimal-error explanation is speculation, not confirmed." }, "chains": [ "solana" ], "method": "agent-hijack", "product": "Lobstar Wilde, an experimental AI trading agent on X", "tags": [ "solana", "agent-hijack", "ai-agent", "ai-trading-bot", "lobstar", "x-replies", "social-engineering", "memecoin", "ai" ], "amountUsd": 250000, "victims": 1, "startedAt": "2026-02-22", "closedAt": "2026-02-22", "updatedAt": "2026-02-22T12:00:00Z", "summary": "On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval." }, { "slug": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026", "title": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys", "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026", "json": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json", "status": "live", "severity": "high", "threatStatus": "partly-contained", "verification": "verified", "ai": { "role": "agent-target", "note": "Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files." }, "chains": [ "solana", "multi-evm" ], "method": "supply-chain", "product": "OpenClaw (ClawHub) skill users", "tags": [ "solana", "multi-evm", "supply-chain", "openclaw", "clawhub", "ai-agent", "skills", "amos-stealer", "macos", "infostealer", "phantom", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-02-05", "closedAt": null, "updatedAt": "2026-10-22T21:53:35.016Z", "summary": "Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet." }, { "slug": "spl-token-owner-reassignment-false-deposit-feb-2026", "title": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian", "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026", "json": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026.json", "status": "closed", "severity": "low", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": "token-owner-swap", "product": "Liminal Custody Solana deposit monitoring (custodian, exchange-style deposit addresses)", "tags": [ "solana", "token-owner-swap", "spl-token", "setauthority", "false-top-up", "custody", "deposit-spoofing" ], "amountUsd": null, "victims": null, "startedAt": "2026-02-01", "closedAt": "2026-03-31", "updatedAt": "2026-03-31T12:00:00Z", "summary": "In February 2026 Liminal Custody's monitoring caught two low-value attempts that used SetAuthority to reassign an attacker's temporary SPL token account to a customer's deposit address after a net-zero transfer, so systems that look up owners through RPC could credit a deposit that never happened. Liminal says no erroneous credit occurred and no customer funds were affected. Exchanges, custodians and payment apps on Solana should verify the expected associated token account and real balance increases before crediting." }, { "slug": "step-finance-treasury-drain-jan-2026", "title": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down", "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026", "json": "https://drains.watch/i/step-finance-treasury-drain-jan-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": "key-leak", "product": "Step Finance treasury and fee wallets", "tags": [ "solana", "key-leak", "treasury", "team-wallet", "private-key", "step-finance", "solanafloor", "remora", "staking" ], "amountUsd": 40000000, "victims": null, "startedAt": "2026-01-31", "closedAt": "2026-01-31", "updatedAt": "2026-02-23T12:00:00Z", "summary": "On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption." }, { "slug": "meteora-fake-otc-escrow-1-5m-jan-2026", "title": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam", "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026", "json": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": "social-engineering", "product": "Meteora treasury (OTC buyback of MET)", "tags": [ "solana", "social-engineering", "otc", "escrow", "impersonation", "treasury", "meteora", "usdc" ], "amountUsd": 1500000, "victims": 1, "startedAt": "2026-01-17", "closedAt": "2026-01-17", "updatedAt": "2026-04-30T12:00:00Z", "summary": "On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel." }, { "slug": "bookmarklet-drains-solana-trading-terminals-wave", "title": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps", "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave", "json": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave.json", "status": "live", "severity": "high", "threatStatus": "active", "verification": "verified", "chains": [ "solana" ], "method": "bookmarklet", "product": "Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)", "tags": [ "solana", "bookmarklet", "campaign", "axiom", "fomo", "trading-terminal", "embedded-wallet", "session-hijack", "fake-verification", "drainer-tooling" ], "amountUsd": null, "victims": null, "startedAt": "2025-12-26", "closedAt": null, "updatedAt": "2026-10-08T12:00:00Z", "summary": "Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small." }, { "slug": "axiom-bookmark-method-drains-dec-2025", "title": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K", "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025", "json": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "unverified", "traction": "X trending topic on 26 Dec 2025 headlined 'Axiom Trade Bookmark Scam Drains Over $200,000 from Wallets' (seen as a search result; the page itself was not readable). Warning post by @insidecalls the same day showed about 43,000 views, 106 likes, 44 replies and 14 reposts when read on 22 Oct 2026. The original post with the $200K claim could not be found or opened.", "chains": [ "solana" ], "method": "bookmarklet", "product": "Axiom trading terminal users", "tags": [ "solana", "bookmarklet", "axiom", "trading-terminal", "session-hijack", "fake-token-checker", "memecoin", "social-report" ], "amountUsd": null, "victims": null, "startedAt": "2025-12-26", "closedAt": "2025-12-26", "updatedAt": "2025-12-26T12:00:00Z", "summary": "In late December 2025, X users warned that scammers were luring Axiom traders with fake tools such as token checkers and getting them to drag a bookmark into the browser, which ran on the logged-in Axiom page and gave the scammer access to the victim's funds. An X trending summary headlined the scam as draining over $200,000, and one widely viewed warning post said a person the author knew had recently fallen for it and asked Axiom to patch it. No security firm, news outlet or Axiom statement confirming the amount was found. Axiom users should never run a bookmark someone gives them and should move funds if they did." }, { "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025", "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana", "bitcoin", "ethereum" ], "method": "malicious-extension", "product": "Trust Wallet Chrome extension v2.68", "tags": [ "solana", "bitcoin", "ethereum", "malicious-extension", "trust-wallet", "browser-extension", "chrome-web-store", "seed-phrase", "leaked-api-key", "wallet", "supply-chain", "shai-hulud", "npm", "seed-phrase-theft" ], "amountUsd": 8500000, "victims": 2520, "startedAt": "2025-12-24", "closedAt": "2025-12-25", "updatedAt": "2025-12-31T12:00:00Z", "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected." }, { "slug": "solana-owner-permission-phishing-3m-dec-2025", "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss", "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025", "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "solana" ], "method": "token-owner-swap", "product": "Solana wallet user (single victim)", "tags": [ "solana", "token-owner-swap", "owner-permission", "assign", "setauthority", "simulation-blind-spot", "okx-wallet", "phantom", "slowmist", "signature-phishing", "account-takeover", "misttrack", "whale" ], "amountUsd": 3000000, "victims": 1, "startedAt": "2025-12-05", "closedAt": null, "updatedAt": "2026-10-22T20:36:38.517Z", "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner." }, { "slug": "upbit-solana-hot-wallet-hack-nov-2025", "title": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected", "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025", "json": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": null, "product": "Upbit exchange Solana hot wallet", "tags": [ "solana", "exchange", "cex", "hot-wallet", "upbit", "lazarus", "north-korea" ], "amountUsd": 36000000, "victims": null, "startedAt": "2025-11-27", "closedAt": "2025-11-27", "updatedAt": "2025-11-28T12:00:00Z", "summary": "On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing." }, { "slug": "dmt-airdrop-dexmaxai-phishing-nov-2025", "title": "DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana", "url": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025", "json": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": "fake-airdrop-site", "product": "DMT airdrop claimants (@dexmaxai)", "tags": [ "solana", "fake-airdrop-site", "airdrop", "dmt", "dexmaxai", "x-account", "claim-phishing" ], "amountUsd": 130000, "victims": null, "startedAt": "2025-11-20", "closedAt": "2025-11-20", "updatedAt": "2025-11-20T12:00:00Z", "summary": "SlowMist's hack database lists a $130,000 phishing loss on Nov 20, 2025, filed under Solana, tied to the DMT token airdrop promoted by the X account @dexmaxai. The airdrop claim was the lure for the phishing. If you claimed DMT, check your wallet for token delegations or unexpected outgoing transfers and move what is left to a new wallet." }, { "slug": "solana-address-poisoning-wave-2025-2026", "title": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses", "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026", "json": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026.json", "status": "live", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "solana" ], "method": "address-poisoning", "product": "Solana wallet users sending to exchange deposit addresses", "tags": [ "solana", "address-poisoning", "dusting", "usdt", "usdc", "phantom", "exchange-deposit", "bitquery" ], "amountUsd": 940106, "victims": 1104, "startedAt": "2025-11-17", "closedAt": null, "updatedAt": "2026-10-12T12:00:00Z", "summary": "Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history." }, { "slug": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025", "title": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads", "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025", "json": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "ai": { "role": "ai-malware", "note": "Safety's researchers say the code appears largely AI-generated, citing emojis, heavy comments and logging they link to Anthropic's Claude; this is an inference from code style." }, "chains": [ "solana" ], "method": "supply-chain", "product": "npm package @kodane/patch-manager", "tags": [ "solana", "supply-chain", "npm", "kodane", "ai-generated-code", "claude", "wallet-drainer", "postinstall", "safety", "railway", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2025-07-28", "closedAt": "2025-07-30", "updatedAt": "2025-08-01T12:00:00Z", "summary": "On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published." } ], "changes": [ { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-10-21", "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.", "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-10-20", "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.", "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-16", "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.", "sourceUrl": "https://rekt.news/factory-sealed", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-14", "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-13", "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "solana-address-poisoning-wave-2025-2026", "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-10-12", "title": "CryptoSlate reported that 1,104 wallets in a studied subset paid $940,106 to poisoned addresses, described as a minimum.", "sourceUrl": "https://cryptoslate.com/?p=571247", "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-11", "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.", "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-10", "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-09", "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.", "sourceUrl": "https://rekt.news/factory-sealed", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-09", "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "solana-address-poisoning-wave-2025-2026", "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-10-09", "title": "Bitquery published findings that 4,497,798 Solana wallets were targeted with lookalike addresses over about 11 months.", "sourceUrl": "https://cryptoslate.com/?p=571247", "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026" }, { "incident": "fomo-bookmarklet-fake-verification-oct-2026", "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-10-08", "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.", "sourceUrl": "https://x.com/evilcos/status/2108000520493490578", "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026" }, { "incident": "fomo-bookmarklet-fake-verification-oct-2026", "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-10-08", "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.", "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578", "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026" }, { "incident": "fomo-bookmarklet-fake-verification-oct-2026", "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-10-08", "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.", "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36", "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026" }, { "incident": "fomo-bookmarklet-fake-verification-oct-2026", "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-10-08", "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.", "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169", "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026" }, { "incident": "bookmarklet-drains-solana-trading-terminals-wave", "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps", "severity": "high", "status": "live", "threatStatus": "active", "date": "2026-10-08", "title": "SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.", "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36", "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-10-06", "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-09-27", "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-09-24", "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "bookmarklet-drains-solana-trading-terminals-wave", "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps", "severity": "high", "status": "live", "threatStatus": "active", "date": "2026-09-09", "title": "Socket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.", "sourceUrl": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave" }, { "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026", "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons", "severity": "high", "status": "live", "threatStatus": "partly-contained", "date": "2026-08-30", "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/", "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026" }, { "incident": "triple-a-hot-wallets-drained-jul-2026", "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-07-25", "title": "PeckShield amplified the alert as estimates rose above $9.7M; Triple-A had not yet confirmed the breach.", "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/", "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026" }, { "incident": "triple-a-hot-wallets-drained-jul-2026", "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-07-24", "title": "Analyst Specter flagged suspicious transfers from Triple-A hot wallets, first estimated at over $9.3M.", "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/", "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026" }, { "incident": "ill-bloom-weak-seed-randomness-drains-may-2026", "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-07-06", "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.", "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026" }, { "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026", "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-06-30", "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.", "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/", "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026" }, { "incident": "ill-bloom-weak-seed-randomness-drains-may-2026", "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-05-27", "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.", "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026" }, { "incident": "fake-cjup-jupiter-airdrop-drainer-may-2026", "incidentTitle": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-05-22", "title": "COINTURK reported Solana Floor's warning about fake $CJUP tokens impersonating Jupiter's Jupuary and linking to wallet drainers.", "sourceUrl": "https://en.coin-turk.com/fake-cjup-airdrop-drains-solana-wallets-within-minutes/", "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026" }, { "incident": "meteora-fake-otc-escrow-1-5m-jan-2026", "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-30", "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.", "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss", "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026" }, { "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026", "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-04-29", "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.", "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto", "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026" }, { "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-04-15", "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026" }, { "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-04-14", "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026" }, { "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-04-08", "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-04-03", "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.", "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-04-01", "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-04-01", "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.", "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026", "incidentTitle": "Solana wallet MCP server on PyPI sent users' private keys to a remote server", "severity": "medium", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-31", "title": "Malicious-package advisory MAL-2026-2315 was published for latinum-wallet-mcp versions 0.0.32 to 0.0.36.", "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-2315", "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026" }, { "incident": "spl-token-owner-reassignment-false-deposit-feb-2026", "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian", "severity": "low", "status": "closed", "threatStatus": "contained", "date": "2026-03-31", "title": "Liminal publishes a write-up of the 'false top-up' technique and says it deployed instruction-level filtering and ATA validation.", "sourceUrl": "https://www.liminalcustody.com/?p=21280", "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-03-30", "title": "A new durable nonce account tied to a member of the updated multisig appeared.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-03-27", "title": "Drift executed a planned Security Council migration to replace a member.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "npm-galedonovan-solana-key-stealers-mar-2026", "incidentTitle": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys", "severity": "medium", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-26", "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.", "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/", "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026" }, { "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026", "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-03-23", "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift", "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026" }, { "incident": "bonk-fun-domain-hijack-drainer-mar-2026", "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt", "severity": "high", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-12", "title": "The Block reported the team told users not to interact with the website until it was secured; the operator said losses were minimal.", "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked", "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026" }, { "incident": "bonk-fun-domain-hijack-drainer-mar-2026", "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt", "severity": "high", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-11", "title": "Bonk.fun's official domain began serving a drainer behind a fake terms-of-service signature after a team account was hijacked.", "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked", "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026" }, { "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026", "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-02-28", "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.", "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto", "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026" }, { "incident": "step-finance-treasury-drain-jan-2026", "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-02-23", "title": "Step Finance said it would end operations along with SolanaFloor and Remora Markets after the roughly $40M loss.", "sourceUrl": "https://www.theblock.co/post/390964/step-finance-shuts-down", "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026" }, { "incident": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "incidentTitle": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-02-22", "title": "The Lobstar Wilde agent replied to a request for 4 SOL and transferred about 53 million LOBSTAR tokens, worth about $250,000, to the requester's wallet.", "sourceUrl": "https://www.theblock.co/post/390722/ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy", "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026" }, { "incident": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026", "incidentTitle": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys", "severity": "high", "status": "live", "threatStatus": "partly-contained", "date": "2026-02-05", "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.", "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap", "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026" }, { "incident": "spl-token-owner-reassignment-false-deposit-feb-2026", "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian", "severity": "low", "status": "closed", "threatStatus": "contained", "date": "2026-02-01", "title": "During February, Liminal Custody's SOC detects and neutralises two low-value SPL token-account ownership reassignment attempts (exact days not published).", "sourceUrl": "https://www.liminalcustody.com/?p=21280", "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026" }, { "incident": "step-finance-treasury-drain-jan-2026", "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-01-31", "title": "Step Finance reported a breach of some treasury wallets; CertiK reported 261,854 SOL (about $27M) unstaked and transferred.", "sourceUrl": "https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations", "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026" }, { "incident": "meteora-fake-otc-escrow-1-5m-jan-2026", "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-01-17", "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.", "sourceUrl": "https://hacked.slowmist.io/?c=Solana", "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026" }, { "incident": "solana-owner-permission-phishing-3m-dec-2025", "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-01-07", "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.", "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/", "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-31", "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.", "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-27", "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.", "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "bookmarklet-drains-solana-trading-terminals-wave", "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps", "severity": "high", "status": "live", "threatStatus": "active", "date": "2025-12-26", "title": "X users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.", "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834", "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave" }, { "incident": "axiom-bookmark-method-drains-dec-2025", "incidentTitle": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-12-26", "title": "@insidecalls posted a warning video about the 'Axiom Bookmark Method', saying someone they knew had recently fallen for it, and asked Axiom to patch it.", "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834", "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025" }, { "incident": "axiom-bookmark-method-drains-dec-2025", "incidentTitle": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2025-12-26", "title": "An X trending topic summarized posts saying an Axiom bookmark scam had drained over $200,000 from wallets.", "sourceUrl": "https://x.com/i/trending/2004611057839378907", "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-26", "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.", "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-25", "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.", "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-24", "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.", "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "solana-owner-permission-phishing-3m-dec-2025", "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2025-12-05", "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.", "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860", "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025" }, { "incident": "solana-owner-permission-phishing-3m-dec-2025", "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2025-12-05", "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.", "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited", "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025" }, { "incident": "upbit-solana-hot-wallet-hack-nov-2025", "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-11-28", "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.", "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe", "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025" }, { "incident": "upbit-solana-hot-wallet-hack-nov-2025", "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-11-27", "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.", "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe", "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025" }, { "incident": "dmt-airdrop-dexmaxai-phishing-nov-2025", "incidentTitle": "DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-11-20", "title": "SlowMist's hack database recorded a $130,000 phishing loss tied to the DMT airdrop promoted by @dexmaxai.", "sourceUrl": "https://hacked.slowmist.io/?c=Solana", "url": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025" }, { "incident": "solana-address-poisoning-wave-2025-2026", "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2025-11-17", "title": "A Solana wallet sent a $10 USDT test to its Gate.io deposit address; 12 seconds later a lookalike sent dust, and the wallet then sent 30,749.80 USDT to the lookalike.", "sourceUrl": "https://cryptoslate.com/?p=571247", "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026" }, { "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025", "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-08-01", "title": "The Register reported more than 1,500 downloads and the signs of AI-written code.", "sourceUrl": "https://www.theregister.com/2025/08/01/emoji_use_ai_malware/", "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025" }, { "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025", "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-07-31", "title": "Safety published its analysis, including the attacker's Solana address and an open command server.", "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer", "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025" }, { "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025", "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-07-30", "title": "npm marked the package as malicious.", "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer", "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025" }, { "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025", "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-07-28", "title": "The package was first published to npm; 19 versions followed over two days.", "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer", "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025" } ] }