If your Solana wallet was drained, stop signing anything, create a brand-new wallet with a new seed phrase on a clean device, and move whatever is left into it right away. Then trace the drain on Solscan to find the cause, report it to any exchange that received the funds and to IC3 or your local cybercrime agency, and ignore anyone who offers to "recover" your crypto for a fee.
Risk notice: Crypto trading is high risk and memecoins can go to zero in minutes. Hot wallets, trading bots and wallet connections can all be drained, and on-chain losses are usually permanent. This page is not financial advice; only keep in a hot wallet what you can afford to lose.
Facts on this page were checked October 23, 2026, from Solana's own docs, wallet providers' guidance and the sources linked below. This is a research-based guide built from published sources, not a hands-on trial.
Step 1: Stop the bleeding (first 10 minutes)
- Stop signing. Close the site or bot you were using. Don't approve any more transactions from the old wallet except the ones that move funds out.
- Check your device. If you think malware or a bad browser extension is involved, use a different, clean device for the next steps. Trust Wallet's guidance is to check for malware first and finish recovery on another device if you can't be sure (Trust Wallet).
- Create a new wallet with a new seed phrase. Don't just add a new account inside the same wallet: in Phantom, Solflare and similar wallets, extra accounts usually come from the same seed, so they are compromised too. Write the new phrase on paper, not in a notes app or screenshot.
- Move what's left. Send remaining SOL, tokens and NFTs to the new address. Do SOL-denominated and liquid tokens first. If the attacker has your seed, they may be running a script that sweeps new deposits, so don't send SOL in to "pay fees" unless you're ready to move everything in the same minute.
- Empty trading bots and terminals linked to the old wallet or to your accounts. Withdraw to the new address. If the bot wallet's key was exported into the drained wallet app, treat the bot wallet as exposed too.
Step 2: Revoke delegates and close what's left
On Solana, most drains are direct transfers rather than lingering approvals; Scam Sniffer found "the majority of phishing signatures on Solana involve initiating direct transfers" (Scam Sniffer). Delegates still exist, though. A token account can have a delegate that is allowed to move or burn its tokens.
- Revoke any delegate. Revoking "clears the token account's current delegate and resets the delegated amount to zero," and the account owner signs it (Solana docs). Technical users can run
spl-token revoke <TOKEN_ACCOUNT>from the Solana CLI. - Close empty token accounts once you've moved the tokens out, to recover rent. Use a tool you reach by typing its URL, and read is Sol Incinerator safe? first. Never use a "claim," "refund" or "airdrop checker" site that shows up after a hack; that is a common second drain.
- Know the limits. Revoking only helps against a delegate. If your seed or private key leaked, the attacker signs as you and revoking does nothing; moving to a new seed is the only fix.
Step 3: Read the drain on Solscan
Paste your old address into Solscan and open the transactions around the time funds disappeared. Look at three things:
| What you see | Likely meaning |
|---|---|
| A transfer signed by your wallet, at a time you weren't using any site | Seed phrase or private key leaked |
| A transfer in the same transaction as something you approved on a website | Drainer site: you signed it |
| A transfer signed by another address as delegate | A delegate approval you gave earlier |
| An owner or authority change, then transfers you can't block | Owner-permission phishing |
| Funds you sent yourself to an address that looks almost like yours or an exchange's | Address poisoning |
Then follow the funds. Click the receiving address and see where it sends next. If Solscan labels a destination as a centralized exchange deposit address, write down the transaction signatures; that exchange is your best chance of a freeze.
Step 4: Identify the cause
Drainer site. You connected a wallet to a fake claim page, a clone of a known app or a "migration" page, and signed. Clones of tools such as Sol Incinerator, FOMO and Padre are documented on our Sol Incinerator, FOMO and Padre safety pages. Scam Sniffer also documented drainers that fake or dodge transaction simulations, so a "simulation failed" warning followed by signing is a classic pattern.
Owner-permission phishing. A newer Solana trick: the transaction shows no balance change but hands ownership of your wallet or accounts to the attacker. SlowMist described a Q4 2025 case where a victim signed "a seemingly normal transaction signature that involved no immediate asset movement" and lost $3 million (SlowMist). If the owner was changed, you may not be able to move remaining funds at all.
Leaked seed or key. The phrase was typed into a fake "support" form or a fake wallet app, stored in cloud notes or screenshots, or a bot key was exported and imported into an untrusted tool. BONKbot said the victims of a March 2024 drain had all exported their keys and imported them elsewhere (Decrypt). More in is BONKbot safe?
Malicious bot or extension. A browser extension or Telegram bot can sign or alter transactions. In November 2025, researchers found a Chrome extension, Crypto Copilot, that secretly added a SOL transfer to users' Raydium swaps (The Hacker News). Fake Telegram trading bots that ask you to import a wallet are another route; see Telegram trading bot security.
Address poisoning. Attackers send dust from a vanity address that matches the first and last characters of one you use, hoping you copy it from your history. Blockaid found a Telegram bot built to automate Solana poisoning, picking targets from DexScreener and Pump.fun holder lists (Blockaid, March 2026). Here nothing was "hacked"; you sent the funds.
If the loss came from a token going to zero rather than a theft, that's a rug pull, not a drain: see how to spot a rug pull on Solana.
Step 5: Beware recovery scams
After a drain, you will see replies and DMs from "recovery experts," "blockchain investigators" and law firms. Assume they are scams. The FBI warned in August 2025 that "there are no law firms which are officially authorized partners of US Government agencies" and that requests for payment for recovery are a red flag (FBI IC3). An earlier FBI alert counted over $9.9 million lost to fake recovery firms (Bitdefender).
Rules: no one can reverse a Solana transaction, no one needs your old or new seed phrase to "trace" funds, and anyone asking for an upfront fee, a "gas deposit" or a wallet connection to "release" funds is trying to take more.
Step 6: Report it
- Exchange. If funds reached a centralized exchange, contact its support or compliance team with your address, the transaction signatures and the receiving deposit address. Speed matters.
- Law enforcement. In the US, file at IC3 and contact your local FBI field office, as the FBI advises. Elsewhere, use your national cybercrime or fraud reporting service. Keep the report number for your records and for tax purposes (Solana memecoin taxes).
- The platform. Tell the wallet, bot or app involved, through its official support channel only. Phantom, for example, says its Help Center is "the one and only channel" for its support (Phantom).
- The scam site. Report drainer domains to your wallet's phishing list and to blocklists, which helps others.
Prevention for next time
- Split wallets: a vault wallet that never connects to sites, and a small trading wallet for bots and terminals.
- Use a hardware wallet for the vault, as SlowMist and Trust Wallet both suggest for larger balances.
- Type or bookmark URLs. Never click claim links from airdropped tokens, NFTs, ads or DMs.
- Read every signature. Reject a failed simulation, an owner or authority change, or outgoing assets you didn't expect.
- Never type a seed phrase into a website, form, bot or "support" chat.
- Check the full address before sending; SlowMist suggests at least the first 6 and last 8 characters.
- Audit extensions and remove ones you don't need.
- Choose bots with a clean record; see are Solana trading bots safe? and the safest Solana trading bot ranking.