Wallet drainers have stolen hundreds of millions of dollars worth of crypto across all chains, and Solana is no exception. Unlike the slow-moving rug pulls and exit scams that many traders have learned to spot, drainers work instantly — one signed transaction and your wallet is empty. Tokens, SOL, NFTs, everything gone in a single block.
Understanding how drainers work is the best defense against them. This guide covers the mechanics of Solana wallet drainers, the latest techniques being used in 2026, and concrete steps you can take to protect yourself.
How Wallet Drainers Work
A wallet drainer is a malicious smart contract or transaction designed to transfer assets out of your wallet when you sign what appears to be an innocent transaction. The attack always follows the same general pattern:
- Lure: Get the victim to visit a malicious website or interact with a malicious link
- Request: Prompt the victim to sign a transaction through their wallet
- Execute: The signed transaction transfers the victim's assets to the attacker's wallet
The sophistication is in step 2 — making the transaction request look legitimate while hiding the actual malicious instructions.
Common Drainer Techniques on Solana
Technique 1: Malicious dApp Approval
The most common drainer disguises itself as a legitimate dApp interaction. You visit a website that looks like a token claim page, an airdrop, a mint, or a DeFi protocol. The site asks you to connect your wallet and sign a transaction.
The transaction you are signing does not do what the site claims. Instead, it contains instructions to:
- Transfer your SOL to the attacker's wallet
- Transfer specific SPL tokens to the attacker
- Set the attacker as a delegate on your token accounts (allowing them to withdraw later)
Technique 2: Token Account Delegation
This is one of the most dangerous techniques because it does not immediately drain your wallet. Instead, the transaction sets a delegate on your token accounts.
How delegation works on Solana:
- Every SPL token account can have a "delegate" — another wallet authorized to transfer tokens from that account
- When you approve a delegate, you specify how many tokens they can transfer
- The malicious transaction sets the attacker's wallet as delegate with maximum allowance
- The attacker can drain the tokens at any time, even days later
This delayed drain makes it harder to connect the theft to the malicious transaction you signed. By the time your tokens disappear, you may not remember which site you interacted with.
Technique 3: Versioned Transactions with Lookup Tables
Solana's versioned transactions (V0) use address lookup tables to compress transaction data. Drainers exploit this by hiding the actual destination addresses in lookup tables that are harder to parse in wallet previews.
When your wallet shows the transaction summary, it may display the lookup table address rather than the actual destination wallet. This makes it harder to spot that your assets are being sent to an unknown address.
Technique 4: CPI-Based Drains
Cross-Program Invocation (CPI) allows one Solana program to call another. A drainer contract might appear to call a legitimate program (like the SPL token program) but actually invoke a malicious program that re-routes the tokens through intermediate accounts before reaching the attacker.
The transaction preview in your wallet shows a call to the SPL token program, which looks normal. But the actual execution path moves tokens through the drainer's program first.
Technique 5: NFT/Token Airdrop Bait
You receive a random NFT or token in your wallet. The token has a description or name that includes a URL — something like "Claim 500 SOL at freesol.xyz." Curious users visit the URL, connect their wallet, and sign the drainer transaction.
Variations include:
- Tokens with metadata pointing to phishing sites
- NFTs that display as claimable rewards
- Airdropped tokens that appear to have real value on DEXScreener (wash-traded by the attacker)
The Anatomy of a Drainer Transaction
Here is what a typical drainer transaction looks like on the technical level:
Transaction Instructions:
1. ComputeBudget::SetComputeUnitLimit(300000)
2. ComputeBudget::SetComputeUnitPrice(100000)
3. DrainerProgram::Execute {
victim: [your wallet],
attacker: [attacker wallet],
inner_instructions: [
SPLToken::Transfer { from: victim_sol_ata, to: attacker_ata, amount: ALL },
SPLToken::Transfer { from: victim_token1_ata, to: attacker_ata, amount: ALL },
SPLToken::Transfer { from: victim_token2_ata, to: attacker_ata, amount: ALL },
]
}
The drainer program iterates through all token accounts associated with your wallet and transfers each one. The entire drain happens in a single transaction, a single block — less than 400 milliseconds.
How Wallets Protect You
Modern Solana wallets have implemented several anti-drainer features.
Transaction Simulation
Phantom, Solflare, and Backpack simulate every transaction before you sign it. The simulation shows you the actual effects of the transaction: which tokens will be transferred, which approvals will be granted, and the net change to your balances.
This is your primary line of defense. When you see a transaction preview showing token transfers out of your wallet that you did not expect, reject it immediately.
Malicious Site Warnings
Phantom and other wallets maintain blocklists of known drainer websites. When you visit a flagged domain and attempt to connect your wallet, the wallet shows a warning. However, blocklists are reactive — new drainer sites are created faster than they can be flagged.
Simulation Bypass Detection
Some sophisticated drainers attempt to detect when a transaction is being simulated (versus actually executed) and behave differently. They may show benign behavior during simulation but execute malicious instructions during real execution. Wallet developers have implemented countermeasures, but this is an ongoing cat-and-mouse game.
Protection Strategies
Strategy 1: Use a Separate Wallet for Interactions
Maintain at least two wallets:
- Vault wallet: Holds your main portfolio. Never connects to any dApp. Only used for receiving and sending between your own wallets.
- Active wallet: Used for trading, minting, and dApp interactions. Only holds the SOL/tokens you are actively trading with.
If your active wallet gets drained, you lose only what was in it — not your entire portfolio. Replenish the active wallet from the vault as needed.
This single practice prevents more losses than all other measures combined.
Strategy 2: Read Every Transaction Preview
Before signing any transaction, read the simulation preview:
- Check outgoing transfers: Are any tokens leaving your wallet? Which tokens, and how much?
- Check approvals/delegates: Is the transaction setting a delegate on any token account?
- Check the program being called: Is it a known program (SPL Token, Jupiter, Raydium) or an unknown contract?
- Check the destination: If tokens are being transferred, where are they going? Is it an address you recognize?
If anything looks unexpected, reject the transaction. It is always better to miss a legitimate opportunity than to sign a drainer.
Strategy 3: Verify URLs Independently
Never click links from:
- Discord DMs or server messages claiming airdrops or mints
- Twitter/X replies or DMs with claim links
- Telegram messages from unknown users
- Emails claiming to be from Solana projects
- Token metadata in airdropped tokens
If a project announces a claim or mint, go to their official website directly by typing the URL or using a bookmarked link. Do not follow links from social media or messages.
Strategy 4: Revoke Stale Approvals
Periodically check your token account delegates and revoke any you do not recognize.
On Solscan, search your wallet address and look at your token accounts. Check if any have delegates set. If you find a delegate you do not recognize, revoke it immediately through a Solana token revoke transaction.
Phantom also shows active approvals in its security settings — review them periodically.
Strategy 5: Use Hardware Wallets for Large Holdings
Hardware wallets like Ledger add a physical confirmation step. Even if you click "approve" in your browser wallet, the transaction must be confirmed on the hardware device's screen. This gives you a second chance to review the transaction and catch anything suspicious.
For holdings above a few thousand dollars, the inconvenience of a hardware wallet is well worth the protection.
Strategy 6: Test with Small Amounts
When interacting with a new dApp or protocol for the first time, test with a small amount first. Send 0.01 SOL, perform the interaction, and verify the results before committing larger amounts. If the small test transaction drains your 0.01 SOL, you learn the site is malicious at minimal cost.
What to Do If You Get Drained
If you believe your wallet has been drained:
- Stop signing transactions from the compromised wallet immediately
- Transfer remaining assets from the compromised wallet to a new, clean wallet. If the drainer used delegation instead of direct transfer, your remaining tokens are at risk.
- Revoke all approvals and delegates on the compromised wallet
- Do not reuse the compromised wallet for storing significant amounts. While the wallet itself is not compromised (the drainer does not have your private key), any remaining delegates or approvals you missed could be exploited later.
- Report the drainer site to wallet providers (Phantom, Solflare) so they can add it to their blocklists
- Document everything — transaction hashes, drainer website URL, attacker wallet addresses. This information helps security researchers track drainer operators.
Recognizing Social Engineering
The technical drainer is just the payload. The delivery mechanism is always social engineering — manipulating you into visiting the malicious site and signing the transaction.
Common social engineering patterns:
- Urgency: "Claim in the next 30 minutes or lose your allocation"
- Authority: "Official announcement from [popular project]"
- Greed: "500 SOL airdrop for early supporters"
- Fear: "Your wallet has been compromised, visit this site to secure your funds"
- Confusion: Impersonating a real project with a slightly different domain name
Every one of these is designed to override your rational judgment. When you feel urgency or excitement about a crypto interaction, that is exactly when you should slow down and verify independently.
Final Thoughts
Wallet drainers are one of the most direct threats to Solana users, and they are becoming more sophisticated every month. But the defense is straightforward: use separate wallets, read transaction previews carefully, never follow links from messages, and verify everything independently.
The most important habit is pausing before you sign. Every drainer requires your signature to execute. That moment — when your wallet pops up asking for approval — is your firewall. Use it. Read the preview, check the destination, and if anything looks wrong, reject it. No legitimate opportunity requires you to sign blindly.
Your wallet security is not about the tools you use — Phantom, Solflare, and Backpack all provide strong protection. It is about the habits you build. Develop a healthy skepticism, separate your funds across wallets, and treat every transaction signing as a security decision.
FAQ
Can a drainer steal my SOL without me signing anything?
No. On Solana, every transfer requires a signature from the source wallet's private key. A drainer cannot move your assets without you signing a transaction. The exception is if you previously approved a delegate on a token account — the delegate can transfer tokens without additional signatures. This is why revoking stale approvals is important.
Are airdropped tokens dangerous to hold?
Holding an airdropped token in your wallet is not dangerous by itself. The token sitting in your account cannot drain other assets. The danger comes from interacting with malicious sites linked in the token's metadata. You can safely ignore airdropped tokens. If you want to remove them, you can close the token account using Solscan or your wallet's built-in tools.
Do transaction simulations catch all drainers?
Most, but not all. Sophisticated drainers can attempt simulation evasion — behaving differently during simulation versus real execution. Wallet developers continually improve simulation accuracy, but no simulation is 100% guaranteed to catch every attack vector. This is why defense in depth (separate wallets, URL verification, small test transactions) is important rather than relying solely on simulation previews.
Can I get my drained tokens back?
In almost all cases, no. Solana transactions are irreversible. Once the drainer transfers your tokens, they typically swap them immediately and route the proceeds through multiple wallets to obscure the trail. Law enforcement has successfully traced and recovered funds in some high-profile cases, but for individual drains, recovery is extremely unlikely. Prevention is the only reliable strategy.
