# Solana · Drain Watch

27 incidents, 9 live. JSON: https://drains.watch/t/solana.json · RSS: https://drains.watch/t/solana/feed.xml

- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets) (live, Critical, Partly contained, since Oct 9, 2026)
- [Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet](https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026) (live, Medium, Still active, since Oct 8, 2026)
- [Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise](https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026) (closed, Critical, Contained, since Sep 24, 2026)
- [19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons](https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026) (live, High, Partly contained, since Aug 30, 2026)
- [Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON](https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026) (live, Critical, Partly contained, since Jul 24, 2026)
- ['Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses](https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026) (closed, Medium, Still active, since Jun 30, 2026)
- ['Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included](https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026) (closed, Critical, Still active, since May 27, 2026)
- [Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites](https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026) (closed, Medium, Still active, since May 22, 2026)
- [Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts](https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026) (closed, Critical, Partly contained, since Apr 8, 2026)
- [Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions](https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026) (live, Critical, Contained, since Apr 1, 2026)
- [Solana wallet MCP server on PyPI sent users' private keys to a remote server](https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026) (closed, Medium, Partly contained, since Mar 31, 2026)
- [Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys](https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026) (closed, Medium, Partly contained, since Mar 26, 2026)
- [Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt](https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026) (closed, High, Partly contained, since Mar 11, 2026)
- [Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent](https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026) (closed, Medium, Still active, since Feb 28, 2026)
- [AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL](https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026) (closed, High, Contained, since Feb 22, 2026)
- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026) (live, High, Partly contained, since Feb 5, 2026)
- [SPL token-account ownership reassignment used to fake deposits at a Solana custodian](https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026) (closed, Low, Contained, since Feb 1, 2026)
- [Step Finance treasury wallets drained of about $40M; Solana platform later shuts down](https://drains.watch/i/step-finance-treasury-drain-jan-2026) (closed, Critical, Contained, since Jan 31, 2026)
- [Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam](https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026) (closed, Critical, Contained, since Jan 17, 2026)
- [Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps](https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave) (live, High, Still active, since Dec 26, 2025)
- ['Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K](https://drains.watch/i/axiom-bookmark-method-drains-dec-2025) (closed, Medium, Still active, since Dec 26, 2025)
- [Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets](https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025) (closed, Critical, Contained, since Dec 24, 2025)
- [Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss](https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025) (live, Critical, Partly contained, since Dec 5, 2025)
- [Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected](https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025) (closed, Critical, Contained, since Nov 27, 2025)
- [DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana](https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025) (closed, High, Contained, since Nov 20, 2025)
- [Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses](https://drains.watch/i/solana-address-poisoning-wave-2025-2026) (live, Critical, Still active, since Nov 17, 2025)
- [AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads](https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025) (closed, High, Contained, since Jul 28, 2025)