Solana Wallet Drainers and Phishing, Explained

A wallet drainer almost never steals your seed phrase directly — it gets you to sign a transaction that hands it permission to move your assets, usually by disguising that transaction as something routine. That distinction matters: the defense against drainers isn’t “guard your seed phrase harder” (though you should), it’s “read what you’re actually approving before you approve it.” This guide covers the specific patterns Solana wallet drainers use and the habits that stop almost all of them.

How a drainer actually works, mechanically

Most Solana drainers use one of two mechanisms. The first is a malicious approval: a transaction that looks like a normal mint, claim, or swap but actually grants the drainer’s contract a standing permission to transfer specific tokens (or all tokens matching certain criteria) out of your wallet, either immediately or at a later time the attacker chooses. The second is a direct transfer disguised as something else: a transaction framed as “claim your airdrop” or “verify your wallet” that is, underneath, just a transfer of your SOL or tokens straight to the attacker’s address. In both cases, your seed phrase stays untouched — the exploit is entirely in what you signed, not in anything being cracked or leaked.

The delivery methods that get you to that signature

• Fake mint or claim sites, often promoted through compromised or paid social accounts, timed around real hype (a real project’s real launch, with a fake site copying it almost exactly).
• Fake support DMs, where someone impersonating official support reaches out first (real support essentially never does this) and walks you through “fixing” a problem by connecting your wallet or signing something.
• Address poisoning and copy-paste malware, where clipboard-hijacking malware swaps an address you’ve copied for a visually similar attacker-controlled one, or a scammer sends a zero-value transaction from an address designed to look like one you’ve legitimately interacted with, hoping you’ll copy it from your history later without checking closely.
• Malicious browser extensions or fake wallet downloads, particularly ones found outside official app stores or linked from search ads rather than the project’s own site.

The habit that stops most of this: read the simulation

Every reputable Solana wallet shows a transaction simulation before you approve — a plain-language (or at least structured) preview of what the transaction will actually do: which tokens move, how much, and to where. The single highest-leverage habit against drainers is actually reading that preview instead of clicking approve on reflex. If a “claim” transaction shows an outgoing transfer instead of an incoming one, or an approval granting access to assets that have nothing to do with what you’re claiming, that’s the scam revealing itself before you’ve lost anything.

Habits that close the rest of the gap

• Never enter your seed phrase into any website, extension, or form, regardless of how official it looks or what problem it claims to be solving. No legitimate wallet, protocol, or support agent will ever ask for it — see our wallets guide for setup basics.
• Verify URLs directly rather than through a link in a DM, comment, or ad — type known addresses from memory or a bookmark you set yourself.
• Use a separate, low-balance “hot” wallet for minting, claiming, and trying new dApps, keeping meaningful value in a wallet you rarely connect to anything new.
• Periodically review and revoke old token approvals you no longer use — a permission granted months ago to a since-compromised or always-malicious contract is a live liability until you revoke it, even if nothing’s happened yet.
• Treat urgency as a signal, not a reason to move fast — “claim before it expires” and “your account will be suspended” framing is designed to short-circuit exactly the pause where you’d otherwise read the simulation.

If you’ve already signed something you shouldn’t have

If you realize immediately, move any remaining assets in that wallet to a fresh wallet before the attacker does — a drainer with a standing approval can often act again later, not just once. Revoke the specific approval if the assets are already gone, to prevent it from being used against anything you add to that wallet later. There’s no recovery mechanism in self-custody DeFi the way a bank can reverse a fraudulent charge — see our DeFi risk guide for the broader picture of why that’s structurally true, not a gap someone forgot to fix.