# My Phantom wallet was drained: what to do in the first hour

> Nobody can reverse it. Phantom says so plainly: it cannot reverse transactions, freeze assets or recover stolen funds. So the first hour is about stopping the bleeding. Disconnect every app, revoke token approvals, and move anything left to a brand new wallet made from a brand new recovery phrase.

Page: https://ravenwallet.pro/blog/phantom-wallet-hacked
Updated: 2026-10-27

## Do these three things first

This is the order Phantom's own help centre gives. Work through it before you spend any time trying to work out exactly what happened.

**1. Disconnect every app.** In Phantom, tap your profile picture, then Settings, then Connected Apps. Disconnect anything you do not recognise. If you are not sure, use Disconnect All. You can always reconnect to a site you trust later.

**2. Revoke token approvals.** Disconnecting an app does not take back the permission you gave it. On Solana, a token account can have one delegate, and that delegate can transfer or burn up to the amount it was approved for. It keeps that right until you cancel it with the token program's Revoke instruction. Phantom's help centre names the tool for this, Famous Fox's Revoker: open it from [Phantom's own page on revoking approvals](https://help.phantom.com/hc/en-us/articles/19142125651731-Revoke-token-approvals), never from a search result or a link someone sends you, then connect Phantom and choose Revoke all.

**3. Move what is left to a new wallet.** Not a new account inside the same wallet. A new wallet with its own recovery phrase. Write the new phrase down offline before you move a single lamport.

If you use Phantom Cash, there is a fourth step. Phantom says to contact its support straight away, remove your Link account at app.link.com/settings so your compromised wallet is no longer tied to your bank, and ring your bank about any unauthorised payment. Phantom support cannot step in with a bank on your behalf.

## Why a new account is not enough

Every account in a Phantom wallet comes from one recovery phrase. That phrase generates every private key and every address in it. Adding account 5 does not help you if whoever drained account 1 has the phrase, because the same twelve words produce account 5 too. See [seed phrase versus private key](/blog/seed-phrase-vs-private-key) for what each one unlocks, and [derivation paths](/blog/solana-derivation-paths) for why one phrase shows several wallets.

So the honest question is whether the attacker has your phrase, or only a permission you signed.

| What you saw | What it suggests | What it means for you |
| --- | --- | --- |
| One coin left, everything else still sitting there | A delegate was set on that one token account | Revoke approvals. Your phrase may still be safe |
| SOL and every coin gone in a single sweep | A signed transaction that emptied the wallet, or your phrase or private key is out | Treat the phrase as burned |
| Funds leave again within minutes of you topping the wallet up | Your phrase or private key is out | Stop sending anything to those addresses, ever |
| An NFT gone after a mint or claim page | A transfer you approved by signing | Revoke approvals and check the rest |

The third row is the one people learn the hard way. A drained wallet that keeps getting drained is not unlucky. It is being watched by a script that holds the key.

## Where the money went, and what you can see

Open your address on an explorer such as [Solscan](https://solscan.io) and look at the transfers. You will see the transaction that took your funds and the address that received them. Everything on Solana is public, so you can follow the money as far as it goes.

That is worth doing for two reasons. It gives you the exact transaction signatures and the destination address, which is what any report needs. And if the funds landed at a centralised exchange deposit address, a report stands a small chance of reaching someone who can freeze them. Small, not good. Most of the time the trail ends at an address nobody controls but the attacker.

What it will not do is get your coins back by itself. There is no undo on Solana.

## Report it

Two places are worth your time:

- **[Chainabuse](https://www.chainabuse.com/report)**, run by TRM Labs and backed by Solana, Circle, Binance US and others. Free, and the reports are read by investigators and exchanges. You report the address, the site or the transaction.
- **Your local police**, and in the United States the FBI's Internet Crime Complaint Center at [ic3.gov](https://www.ic3.gov). Phantom's help centre names both.

Then watch out for the second wave. Phantom warns about recovery scams: people who find drain victims and offer to get the money back. Nobody can reverse a Solana transaction. Phantom support will never ask for your recovery phrase or your private key, and Phantom has no Discord server, so any Discord claiming to be official Phantom support is a scam. Neither will anyone else honest. The recovery phrase of a drained wallet is worthless to you and still dangerous in someone else's hands.

## Can Phantom itself be hacked?

The Phantom app has not been broken into. The closest thing people remember is August 2022, when 9,231 wallets were drained of about $4.1 million over roughly four hours. Some of them were Phantom wallets, and Phantom took the blame in public for a while. Solana's own write up traced it to Slope's mobile app, which had been sending private key material to a logging service. Phantom and Solflare users were only hit if their phrase had been generated or stored in Slope at some point. Hardware wallets were not affected.

That is the pattern for nearly every drain. The wallet software did its job and the key got out some other way: a phrase typed into a fake site, a phrase stored in a notes app or a screenshot, a malicious browser extension, a fake support DM, a clipboard stealer on the computer, or a transaction signed without reading it.

Phantom does list real defences. It flags malicious transactions, it keeps an open source blocklist of phishing sites, and it works with a Ledger. None of those can save a phrase you typed somewhere yourself.

If the drain happened minutes after you connected to a site, it was probably that site. If you cannot point to anything at all, assume the machine is the problem and set the new wallet up somewhere else. For more on what browser wallets can and cannot protect, see [are browser based Solana wallets safe](/blog/are-web-wallets-safe).

## Setting up again, properly

Once the old wallet is empty, delete it in Phantom under Settings, Security and Privacy, Delete Wallet, or reset the app. Leaving it in your list only invites you to use it again by accident.

Then split your money up instead of putting it back in one place. One wallet for connecting to apps, holding only what you are willing to lose. One wallet that never connects to anything, ideally behind a hardware wallet. That way the next bad signature costs you a little rather than everything.

If you are moving private keys out of an old wallet by hand, [the Phantom import and export guide](/blog/phantom-private-key-import-export) covers the formats and the incorrect format error.

## Where Raven fits

Running one wallet for apps and another for savings is the right answer, and it is awkward in a single wallet extension. Raven Wallet is a Solana wallet manager built for exactly that: one vault holds up to 1,000 wallets in folders you name, keys are made in your browser and locked with your password before anything is saved, and Raven's server keeps only that locked copy and cannot open it.

You can bring wallets in from Phantom with a seed phrase or a private key, and a picker shows what each account holds before you add it, which is useful when you are working out what survived. Consolidating the leftovers into one safe wallet is one move: see [moving everything from many wallets into one](/blog/consolidate-solana-wallets).

Raven is invite only for now. Join the [waitlist](/waitlist) and we will email you when it is your turn.

## Questions

### Can Phantom reverse the transaction or recover my funds?

No. Phantom is self custodial, which means only you hold the keys. Phantom states that it cannot reverse blockchain transactions, freeze assets or recover stolen funds, and its support team cannot access your wallet.

### Can Phantom wallet be hacked?

The app itself has not been broken into. Drains almost always come from the key getting out another way: a phrase typed into a phishing site, malware on the computer, a bad browser extension, or a transaction signed without reading it. The 2022 incident that drained 9,231 wallets was traced to Slope's app, not Phantom's.

### Is it safe to keep using the wallet after I revoke approvals?

Only if you are confident the attacker never had your phrase or private key. If there is any doubt, move to a new wallet on a new recovery phrase. A revoke cancels a delegate on a token account; it does nothing about a leaked key.

### Should I pay someone who offers to recover my crypto?

No. Nobody can reverse a Solana transaction, and recovery offers that find you after a loss are a known follow up scam. Phantom warns about them directly. Never type your recovery phrase anywhere except your own wallet app.

## Sources

- [Phantom help: I was scammed or my wallet was drained. What can I do?](https://help.phantom.com/hc/en-us/articles/5487893286291-I-was-scammed-or-my-wallet-was-drained-What-can-I-do)
- [Phantom help: Move funds to a new wallet when you need to start over](https://help.phantom.com/hc/en-us/articles/47679918675475-Move-funds-to-a-new-wallet-when-you-need-to-start-over)
- [Phantom help: Revoke token approvals](https://help.phantom.com/hc/en-us/articles/19142125651731-Revoke-token-approvals)
- [Phantom help: What to expect from Phantom Support](https://help.phantom.com/hc/en-us/articles/42012633428115-What-to-expect-from-Phantom-Support)
- [Phantom help: Protect your Cash account after a compromise](https://help.phantom.com/articles/protect-your-cash-account-after-a-compromise-55663102241299)
- [Solana: 8/2/2022 application wallet incident update](https://solana.com/news/8-2-2022-application-wallet-incident)
- [Solana Token program: authority delegation, Approve and Revoke](https://www.solana-program.com/docs/token)
- [Chainabuse: report a scam](https://www.chainabuse.com/report)