# Is Phantom wallet safe? What can and cannot go wrong

> Yes, Phantom is safe enough for everyday use, if you get it from the official site and treat your recovery phrase as cash. It has outside audits and scam warnings, and we found no confirmed case of its own systems leaking keys. But it cannot undo anything you sign.

Page: https://ravenwallet.pro/blog/is-phantom-safe
Updated: 2026-11-07

## The short answer

Phantom is self-custodial. Your funds sit on the blockchain, and whoever holds the keys controls them. Phantom's security page puts it as "we never have access", and its help centre says it cannot reverse transactions, freeze assets or recover stolen funds.

That cuts both ways. A company cannot lose your money for you, and a company cannot get it back for you. So "is Phantom safe" is really two questions: is the app sound, and can someone trick you?

The app has a decent record. The second question is where people lose money.

## What Phantom does to protect you

- **Outside audits.** Phantom's public audit repository holds two reports, Kudelski Security in 2021 and Least Authority in 2024. An audit checks the code at one moment, so it is evidence and not a guarantee.
- **A live bug bounty.** Phantom's program runs on Cantina, and pays up to $100,000 for a critical bug. Phantom's own security page still says $50,000.
- **Transaction checks.** Phantom simulates a transaction before you sign and flags suspicious activity.
- **A phishing blocklist.** It is open source, and it warns you when a site is on it.
- **Ledger support.** Your private keys stay on the hardware device.

Each of these has limits. If Phantom cannot simulate a transaction, you see "This dApp could be malicious", which means it cannot verify what the transaction will do. And Phantom itself says that you are still at risk even with a Ledger, because a hardware wallet protects the key, not your judgement about what you sign.

## What has actually gone wrong

| When | What happened | Was it Phantom's fault? |
| --- | --- | --- |
| 2021 | Paid Google ads led to [fake Phantom sites](https://research.checkpoint.com/2021/cpr-alerts-crypto-wallet-users-of-massive-search-engine-phishing-campaign-that-has-resulted-in-at-least-half-a-million-dollars-being-stolen/). They showed a recovery phrase that belonged to the attacker, so anything people sent to that wallet was gone. Check Point put losses at half a million dollars or more | No. Fake sites, not the app |
| 2022 | The [Demonic flaw](https://halborn.com/disclosures/demonic-vulnerability/): a phrase typed into a browser wallet could be saved unencrypted to disk by the browser's session restore. An attacker needed access to the computer | Partly. [Decrypt reported](https://decrypt.co/103000/ethereum-wallet-metamask-solana-phantom-demonic-security-bug?amp=1) Phantom fully patched it in April 2022 |
| August 2022 | About $4 million left roughly 9,230 Solana wallets, some of them Phantom's | Phantom said it found no evidence its systems were compromised, and that the users it reviewed had moved their phrase or key to or from a non-Phantom wallet. Attention moved to Slope, a different wallet, [whose logs held some keys in plaintext](https://cointelegraph.com/news/experts-find-private-keys-on-slope-servers-still-puzzled-over-access). Investigators said that did not explain every account |
| April 2025 | A lawyer and 13 others [sued Phantom and OKX](https://decrypt.co/314783/phantom-wallet-sued-500k-meme-coin-theft-alleged-security-flaw) over about $500,000 in stolen memecoins, alleging keys sat unencrypted in browser memory | Not decided. These are allegations, and Phantom denies them. The [last report we found](https://decrypt.co/325919/lawyer-wiener-doge-seperated-phantom-meme-coin-lawsuit), from June 2025, showed the case still pending |
| February 2026 | One person lost about $264,000 in wrapped Bitcoin to [address poisoning](https://cointelegraph.com/news/phantom-chat-address-poisoning-bitcoin-phishing), tied to Phantom's chat. Investigator ZachXBT said its interface did not filter spam | No keys were broken, but the criticism was about Phantom's own screen |
| April 2026 | A [temporary outage](https://www.theblock.co/post/396479/phantom-reports-service-outage) hit prices and balances. Phantom said funds were not affected | An outage, not a theft. Check an explorer before you panic |
| October 2026 | Three fake Firefox extensions copied Phantom, Jupiter and Bitget and stole phrases. The listings have been removed | No. Fake extensions |

Read the last column as a whole. Only one row is a confirmed flaw in Phantom's software, and it needed access to the computer. One is unproven. The rest are fakes, tricks, an outage and a different wallet.

## How people really lose money

**A fake Phantom.** Phantom warns that fake extensions can appear in browser stores and may steal your funds. Install only from the [official download page](https://phantom.com/download), and never from an ad or a link someone sent you.

**A phrase typed in the wrong place.** Phantom's rule is to never enter your recovery phrase into any website, and never keep it in a notes app, photo, email or cloud storage. Write it on paper. Anyone who has it has every account in that wallet: see [seed phrase versus private key](/blog/seed-phrase-vs-private-key).

**Fake support.** Phantom Support will never message you on Discord, X, Telegram or other chat apps, and Phantom has no Discord server. It will never DM or email you first asking you to send funds.

**A bad signature.** Phantom can warn you, but once you approve a transaction there is no undo button. [How Solana wallet drainers work](/blog/solana-wallet-drainers) shows what these requests look like, and if you need to cancel an approval, use [Phantom's page on revoking approvals](https://help.phantom.com/hc/en-us/articles/19142125651731-Revoke-token-approvals).

**A copied address.** Check the full address before you send. Do not copy one from your transaction history.

## If you signed in with Google or Apple

Phantom also lets you make a wallet with a Google or Apple account. New wallets made this way use Phantom KMS, which stores keys in secure enclaves instead of on your device. Your device asks KMS to sign, and KMS checks the request first. Phantom still calls the wallet self-custodial, but this is a different setup from a key that sits only on your own device, and your Google or Apple account now matters as much as the wallet.

Two things to do:

- **Export your recovery phrase and store it offline.** If you lose the Google or Apple account and have no backup, you cannot restore the wallet, and Phantom Support cannot recover it for you.
- **Treat any PIN like your phrase.** After seven wrong attempts, the encrypted backup on that device is deleted.

## How to use it safely

1. Keep one account for long-term holding and another for using apps, as Phantom suggests. Better still, make the savings wallet a separate wallet on its own phrase, because every account in a wallet shares one phrase.
2. Put serious money on a Ledger.
3. Keep little in the wallet you connect to new sites. [Setting up wallets for trading](/blog/trading-wallet-setup) has a simple layout.
4. Read the warnings. Stop if you do not understand what you are signing.
5. Turn on auto-lock.

If it goes wrong anyway, the steps are in [what to do in the first hour](/blog/phantom-wallet-hacked).

## Where Raven fits

The advice above means more wallets, and that is the awkward part in a single extension. Raven Wallet is a Solana wallet manager: one vault holds up to 1,000 wallets in folders you name. Keys are made in your browser and locked with your password before anything is saved, and Raven's server keeps only that locked copy and cannot open it.

Your 12 words bring every wallet back. Without your password or your 12 words, nobody can open your wallets, Raven included, so the same care with your phrase applies. Raven is open to everyone: [open Raven](https://app.ravenwallet.pro/) and make an account.

## Questions

### Has Phantom ever been hacked?

We found no confirmed case of Phantom's own systems being broken into and user keys taken. Phantom said its systems were not compromised in the August 2022 drain. A 2025 lawsuit alleges a flaw in how keys are held, but that is unproven and Phantom denies it.

### Can Phantom steal my crypto?

Phantom says it never has access to your funds and does not keep a copy of your recovery phrase. That is Phantom's own description, and Google or Apple wallets keep keys in its KMS enclaves, so keep your own offline copy of the phrase either way.

### What about the scary posts on Reddit?

A post saying "Phantom drained me" tells you money left, not how. Look for what happened just before: a new site, a new extension, a phrase typed somewhere. Phantom lists Reddit among its official channels, but it says it will never DM you first, so treat any "support" message as a scam.

### Is Phantom safe for large amounts?

Phantom itself recommends a hardware wallet such as a Ledger for high-value assets. Keep that money in a wallet that does not connect to new sites.

## Sources

- [Phantom: Security](https://phantom.com/security)
- [Phantom help: I was scammed or my wallet was drained](https://help.phantom.com/hc/en-us/articles/5487893286291-I-was-scammed-or-my-wallet-was-drained-What-can-I-do)
- [Phantom help: Security tips for Phantom users](https://help.phantom.com/hc/en-us/articles/13515761228051-Security-tips-for-Phantom-users)
- [Phantom help: Understanding Phantom KMS](https://help.phantom.com/hc/en-us/articles/50639521822227-Understanding-Phantom-KMS)
- [Phantom: Audit reports](https://github.com/phantom/audit-reports)
- [Cantina: Phantom bug bounty](https://cantina.xyz/bounties/5314819f-b0b2-4d39-b953-d02ec74cac1a)
- [The Block: Phantom says its systems were uncompromised in $4 million hack](https://www.theblock.co/post/162673/solana-wallet-provider-phantom-says-its-systems-were-uncompromised-in-4-million-hack)
- [Malwarebytes: Malicious Firefox extensions impersonate popular crypto wallets](https://www.malwarebytes.com/blog/news/2026/10/malicious-firefox-extensions-impersonate-popular-crypto-wallets)