Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss
Solana wallet user (single victim)
A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.
Why this severity: $3.0M reported stolen, 1 victims, only partly contained.
- Started
- Dec 5, 2025
- Chains
- Solana
- Reported stolen
- $3.0M
- Victims
- 1
At risk
- Solana wallet user (single victim)
- Solana wallets
What to do now
- Move anything still under your control to a brand-new wallet with a fresh seed phrase. Contact any DeFi protocols where you hold positions; in this case protocols helped recover about $2M. Report the attacker address to your wallet and to security firms.
Stay safe
Am I affected?
If you signed a transaction on an unfamiliar Solana tool or claim site that showed no balance change, and you now cannot revoke permissions or move tokens, check your wallet and token accounts on a Solana explorer. If the owner of an account is no longer your address, that account is under someone else's control.
What to do now
Move anything still under your control to a brand-new wallet with a fresh seed phrase. Contact any DeFi protocols where you hold positions; in this case protocols helped recover about $2M. Report the attacker address to your wallet and to security firms.
How to avoid this
A wallet preview that shows 'no balance change' is not proof a transaction is safe. Read the instruction list and reject anything that assigns, changes the owner of, or sets a new authority on your account or token accounts. Keep your wallet app updated so its owner-change warnings are active.
Timeline 3
OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.
SourceCoinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.
SourceSlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.
Source
Alerts & on-chain evidence 1
News & write-ups ›2
How this method works
A Solana transaction quietly hands ownership of your token accounts (or your whole account) to the attacker, so the tokens are no longer yours to move. Read about token account ownership change →
Follow new drains and updates in your feed reader or Telegram RSS bot.