Learn how Solana wallet drainers steal your tokens, the latest drainer techniques in 2026, and practical steps to protect your wallet from malicious transactions.
Disclosure: This article contains affiliate links. If you sign up through them, MadeOnSol may earn a commission at no extra cost to you. This never affects our rankings, ratings, or reviews.
Wallet drainers have stolen hundreds of millions of dollars worth of crypto across all chains, and Solana is no exception. Unlike the slow-moving rug pulls and exit scams that many traders have learned to spot, drainers work instantly — one signed transaction and your wallet is empty. Tokens, SOL, NFTs, everything gone in a single block.
Understanding how drainers work is the best defense against them. This guide covers the mechanics of Solana wallet drainers, the latest techniques being used in 2026, and concrete steps you can take to protect yourself.
A wallet drainer is a malicious smart contract or transaction designed to transfer assets out of your wallet when you sign what appears to be an innocent transaction. The attack always follows the same general pattern:
The sophistication is in step 2 — making the transaction request look legitimate while hiding the actual malicious instructions.
The most common drainer disguises itself as a legitimate dApp interaction. You visit a website that looks like a token claim page, an airdrop, a mint, or a DeFi protocol. The site asks you to connect your wallet and sign a transaction.
The transaction you are signing does not do what the site claims. Instead, it contains instructions to:
This is one of the most dangerous techniques because it does not immediately drain your wallet. Instead, the transaction sets a delegate on your token accounts.
How delegation works on Solana:
This delayed drain makes it harder to connect the theft to the malicious transaction you signed. By the time your tokens disappear, you may not remember which site you interacted with.
Solana's versioned transactions (V0) use address lookup tables to compress transaction data. Drainers exploit this by hiding the actual destination addresses in lookup tables that are harder to parse in wallet previews.
Tools mentioned
Live health scores, average ratings, and direct links on MadeOnSol.
Swiss-based VPN from the Proton privacy suite — free tier available, includes ProtonMail and ProtonPass
Blockchain security audit firm with Solana smart contract expertise
Elite smart contract security audits trusted by top Solana protocols
Solana token scanner with risk scoring to detect rug pulls
Open-source hardware wallet with Solana support and built-in phishing protection
Build with MadeOnSol API
KOL tracking, deployer intelligence, DEX streaming, and webhooks. Free API key — 200 requests/day.
New customers try Pro free for 5 days — card, cancel anytime.
import { MadeOnSol } from "madeonsol";
// Get a free API key at madeonsol.com/pricing
const client = new MadeOnSol({ apiKey: "msk_your_key" });
const { trades } = await client.kol.feed({ limit: 10 });
const { alerts } = await client.deployer.alerts({ limit: 5 });
const { tools } = await client.tools.search({ q: "trading" });Keep reading
Guides
An honest look at Solana's security track record in 2026. Covers past outages and exploits, current security improvements, wallet safety, common scams, and practical steps to protect your funds.
Reviews
Cypherock X1 replaces the seed phrase with key shards split across a vault and four cards. Here's how the seedless model works, whether it fits Solana holders, and an honest look at the tradeoffs.
Reviews
SafePal bundles an air-gapped hardware wallet, a mobile app, and a crypto card into one multi-chain ecosystem — and it's the cheapest air-gapped wallet around. Here's an honest review, including how its Solana support compares to Phantom.
Guides
A comprehensive security audit checklist for Solana program developers covering common vulnerabilities, testing tools, best practices, and how to choose an audit firm.
Security
Understand how sandwich attacks work on Solana, why they differ from Ethereum, and practical strategies to protect your trades from MEV.
Security
Compare the best hardware wallets for Solana — Ledger, Trezor, and Keystone. Covers Solana-specific support for staking, DeFi, NFTs, security models, pricing, and which wallet pairs best with Phantom or Solflare.
Enjoyed this article?
Real-time KOL trades, Pump.fun deployer intel, and 1,200+ ranked Solana tools — free to explore.
Open the KOL TrackerWhen your wallet shows the transaction summary, it may display the lookup table address rather than the actual destination wallet. This makes it harder to spot that your assets are being sent to an unknown address.
Cross-Program Invocation (CPI) allows one Solana program to call another. A drainer contract might appear to call a legitimate program (like the SPL token program) but actually invoke a malicious program that re-routes the tokens through intermediate accounts before reaching the attacker.
The transaction preview in your wallet shows a call to the SPL token program, which looks normal. But the actual execution path moves tokens through the drainer's program first.
You receive a random NFT or token in your wallet. The token has a description or name that includes a URL — something like "Claim 500 SOL at freesol.xyz." Curious users visit the URL, connect their wallet, and sign the drainer transaction.
Variations include:
Here is what a typical drainer transaction looks like on the technical level:
Transaction Instructions:
1. ComputeBudget::SetComputeUnitLimit(300000)
2. ComputeBudget::SetComputeUnitPrice(100000)
3. DrainerProgram::Execute {
victim: [your wallet],
attacker: [attacker wallet],
inner_instructions: [
SPLToken::Transfer { from: victim_sol_ata, to: attacker_ata, amount: ALL },
SPLToken::Transfer { from: victim_token1_ata, to: attacker_ata, amount: ALL },
SPLToken::Transfer { from: victim_token2_ata, to: attacker_ata, amount: ALL },
]
}
The drainer program iterates through all token accounts associated with your wallet and transfers each one. The entire drain happens in a single transaction, a single block — less than 400 milliseconds.
Modern Solana wallets have implemented several anti-drainer features.
Phantom, Solflare, and Backpack simulate every transaction before you sign it. The simulation shows you the actual effects of the transaction: which tokens will be transferred, which approvals will be granted, and the net change to your balances.
This is your primary line of defense. When you see a transaction preview showing token transfers out of your wallet that you did not expect, reject it immediately.
Phantom and other wallets maintain blocklists of known drainer websites. When you visit a flagged domain and attempt to connect your wallet, the wallet shows a warning. However, blocklists are reactive — new drainer sites are created faster than they can be flagged.
Some sophisticated drainers attempt to detect when a transaction is being simulated (versus actually executed) and behave differently. They may show benign behavior during simulation but execute malicious instructions during real execution. Wallet developers have implemented countermeasures, but this is an ongoing cat-and-mouse game.
Maintain at least two wallets:
If your active wallet gets drained, you lose only what was in it — not your entire portfolio. Replenish the active wallet from the vault as needed.
This single practice prevents more losses than all other measures combined. For a broader look at the full threat landscape and whether the chain itself is the risk, see our overview of whether Solana is safe and how to protect your wallet.
Before signing any transaction, read the simulation preview:
If anything looks unexpected, reject the transaction. It is always better to miss a legitimate opportunity than to sign a drainer.
Never click links from:
If a project announces a claim or mint, go to their official website directly by typing the URL or using a bookmarked link. Do not follow links from social media or messages.
Periodically check your token account delegates and revoke any you do not recognize.
On Solscan, search your wallet address and look at your token accounts. Check if any have delegates set. If you find a delegate you do not recognize, revoke it immediately through a Solana token revoke transaction.
Phantom also shows active approvals in its security settings — review them periodically.
Hardware wallets like Ledger add a physical confirmation step. Even if you click "approve" in your browser wallet, the transaction must be confirmed on the hardware device's screen. This gives you a second chance to review the transaction and catch anything suspicious.
For holdings above a few thousand dollars, the inconvenience of a hardware wallet is well worth the protection.
When interacting with a new dApp or protocol for the first time, test with a small amount first. Send 0.01 SOL, perform the interaction, and verify the results before committing larger amounts. If the small test transaction drains your 0.01 SOL, you learn the site is malicious at minimal cost.
If you believe your wallet has been drained:
The technical drainer is just the payload. The delivery mechanism is always social engineering — manipulating you into visiting the malicious site and signing the transaction.
Common social engineering patterns:
Every one of these is designed to override your rational judgment. When you feel urgency or excitement about a crypto interaction, that is exactly when you should slow down and verify independently.
Wallet drainers are one of the most direct threats to Solana users, and they are becoming more sophisticated every month. But the defense is straightforward: use separate wallets, read transaction previews carefully, never follow links from messages, and verify everything independently.
The most important habit is pausing before you sign. Every drainer requires your signature to execute. That moment — when your wallet pops up asking for approval — is your firewall. Use it. Read the preview, check the destination, and if anything looks wrong, reject it. No legitimate opportunity requires you to sign blindly.
Your wallet security is not about the tools you use — Phantom, Solflare, and Backpack all provide strong protection. It is about the habits you build. Develop a healthy skepticism, separate your funds across wallets, and treat every transaction signing as a security decision.
No. On Solana, every transfer requires a signature from the source wallet's private key. A drainer cannot move your assets without you signing a transaction. The exception is if you previously approved a delegate on a token account — the delegate can transfer tokens without additional signatures. This is why revoking stale approvals is important.
Holding an airdropped token in your wallet is not dangerous by itself. The token sitting in your account cannot drain other assets. The danger comes from interacting with malicious sites linked in the token's metadata. You can safely ignore airdropped tokens. If you want to remove them, you can close the token account using Solscan or your wallet's built-in tools.
Most, but not all. Sophisticated drainers can attempt simulation evasion — behaving differently during simulation versus real execution. Wallet developers continually improve simulation accuracy, but no simulation is 100% guaranteed to catch every attack vector. This is why defense in depth (separate wallets, URL verification, small test transactions) is important rather than relying solely on simulation previews.
In almost all cases, no. Solana transactions are irreversible. Once the drainer transfers your tokens, they typically swap them immediately and route the proceeds through multiple wallets to obscure the trail. Law enforcement has successfully traced and recovered funds in some high-profile cases, but for individual drains, recovery is extremely unlikely. Prevention is the only reliable strategy.
Two habits that reduce your attack surface: revoking unused token approvals regularly, and checking a token for red flags before you ever interact with its contract.
A drainer is a single malicious transaction that empties your wallet the moment you sign it, while a rug pull unfolds when a token's developer pulls liquidity out from under holders, and a fake airdrop is often the bait that lures you into signing the drainer transaction in the first place. Our guides on spotting fake airdrops, honeypots, and other common Solana scams and using RugCheck to vet a token before you ever connect your wallet cover those related threats in detail.