How Solana wallet drainers work, and how to spot one before you sign

A Solana wallet drainer is a fake site that asks you to connect your wallet and sign one transaction. That transaction moves your coins out, hands someone else the right to spend them, or quietly changes who controls your account. Nothing is stolen until you sign, so the whole defence is reading what you sign and saying no.

Updated 28 October 2026 · 6 min read

What a drainer is

A drainer is not a virus on your wallet. It is a website, usually dressed up as an airdrop, a mint or a claim page, running code that builds a harmful transaction and asks your wallet to sign it. Your wallet does exactly what it is told. If you approve, the transaction runs, and there is no undo on Solana.

Most of these sites are not built by the people running them. Mandiant, Google’s threat intelligence team, looked at one drainer kit called CLINKSINK in January 2024. It was sold as a service: the operators handed the code to “affiliates”, who ran the fake sites and kept about 80% of what they stole, while the operators took about 20%, sometimes anywhere from 5% to 25%. Mandiant counted at least 35 affiliate IDs and estimated at least $900,000 stolen. The fake pages pretended to be Phantom, DappRadar and BONK.

The same month, Scam Sniffer tracked two drainers on Solana that took about $4.17 million from about 3,947 victims in roughly a month.

How you get to one

Nobody types a drainer’s address on purpose. The link comes to you:

An airdrop you did not ask for. Scam Sniffer found one gang sending NFTs to token holders with the phishing link written into the NFT’s name and link fields. Curious holders opened it.
A post from an account you trust. Mandiant’s own X account was taken over on 3 January 2024 and used to post a drainer link.
Discord and X replies, fake “claim your tokens” announcements and fake support messages.

The common thread is urgency and free money. A claim that closes in an hour is a reason to slow down, not speed up.

What it asks you to sign

Once you connect, the CLINKSINK code checked which wallet you had, sent your address to its server, and looked up your balance. Then it asked you to sign one transaction framed as claiming the airdrop. If you rejected it, the theft failed. Here is what that one transaction can do on Solana:

What the transaction does	What it means	What you might see before signing
Transfers SOL and your tokens in one go	Everything listed leaves at once	The preview shows coins going out of your wallet
Approves a delegate on a token account	Someone else can move or burn up to the approved amount, until you revoke it	The preview says someone gains the ability to spend your tokens
Changes the owner of a token account	The account, and what is in it, now belongs to someone else	Look for any change of owner or authority
Reassigns your wallet account itself	You can see your funds but can no longer move them	No change in balances at all
Something your wallet cannot simulate	You have no idea what it does	A warning that the app could be malicious

Scam Sniffer says most Solana drains it saw asked for direct transfers, not approvals. That is the first row, and it is the easiest to catch, because the preview shows your coins leaving.

The last three rows are the dangerous ones, because the preview can look calm. Solana’s token program lets an account’s owner hand ownership to someone else with an instruction called SetAuthority, and the token program’s own docs tell wallets never to use it to change the account owner. If a site asks you to sign one, there is no good reason.

The wallet reassignment is newer. In December 2025, SlowMist reported a victim whose account owner had been switched to an address the attacker controlled. The transaction showed no change in funds, so it looked harmless. More than $3 million was taken, and about $2 million sitting in DeFi apps could only be rescued with those apps' help. The victim tried to revoke approvals and could not.

The preview is a guide, not a guarantee

Phantom simulates every transaction to show what may move in and out of your wallet, and flags dangerous effects such as others gaining the ability to spend your tokens. Phantom itself says the simulation does not provide a guarantee.

When Phantom cannot simulate a transaction properly, it shows “This dApp could be malicious. Do not proceed unless you are certain it is safe.” Its help centre says to proceed only if you fully trust the app. Drainers know this. Scam Sniffer found victims who saw a message that the simulation had failed and confirmed the transaction anyway, and drainer kits use tricks to fool simulation or show fake results.

So treat a failed or blank preview as a no. An airdrop claim that your wallet cannot explain is not worth finding out about.

How to spot one before you sign

Ask why a claim needs a signature that moves anything. Receiving a token never needs you to send one.
Read every line of the preview. Coins leaving that you did not choose to send means stop.
Stop on any warning. A malicious site warning, a failed simulation or a new domain notice on a page you reached from a DM are all reasons to close the tab.
Look for permission changes, not just balance changes. SlowMist’s advice after the owner case was to check for hidden operations that modify the owner or other high risk permissions.
Never connect your savings wallet to a new site. Use a separate wallet that holds only what you are willing to lose.
Never type your recovery phrase into a site. A drainer that only gets a signature takes what that transaction allows. A site that gets your phrase gets everything, forever. See seed phrase versus private key.

If you think you signed a token approval, Phantom names a revoke tool on its help page on revoking token approvals; open it from there, never from a link someone sends you. If something has already gone, see what to do in the first hour after a drain.

Where Raven fits

The best defence is a wallet that connects to sites and holds little, kept apart from the wallets that hold your savings. Raven Wallet is a Solana wallet manager that keeps many wallets in one vault, up to 1,000, in folders you name, so a throwaway wallet for new sites is easy to keep. Raven for Chrome connects to Solana sites and shows what each request would do before you sign it. Raven is invite only for now: join the waitlist and we will email you when it is your turn. More on browser wallets in are browser based Solana wallets safe.

Questions

Can a drainer take my funds just because I connected my wallet?

Connecting gives the site your address, and the CLINKSINK kit used it to look up your balance. The theft needs your signature on a transaction. In Mandiant’s analysis, a victim who rejected it lost nothing.

Can a drained transaction be reversed?

No. A signed Solana transaction cannot be undone by your wallet or anyone else. A token approval can be revoked, but anything already moved is gone.

Why did my wallet show no change and I still lost control?

The transaction may have changed who owns your account rather than moving coins. SlowMist reported exactly this in December 2025: the preview showed no fund changes, but the account owner was switched to the attacker.

Is a simulation failed warning always a drainer?

Not always. Some honest apps do unusual things that wallets cannot simulate. But Phantom says to proceed only if you fully trust the app, and drainers rely on people clicking past it.

Sources

Raven for Chrome shows what each request would do before you sign it.

Join the waitlist