A Solana wallet drainer is a scam that tricks you into signing one malicious transaction that empties your wallet, moving your SOL, tokens, and NFTs to an attacker in a single block. It is not a break in Solana itself. It is a permission trick that turns your own signature against you, which is exactly why a hardware wallet and a strong seed phrase do not stop it.
The signature you approve does not simply "send" money. It grants an authority or reassigns an account, so everything can move at once the instant you confirm. That design is why a drain feels instant and total rather than piecemeal. The good news is that these attacks are shrinking: phishing and drainer losses fell about 83% in 2025 to roughly $83.85 million, according to one industry tracker (source: Scam Sniffer's 2025 report). The sobering part is that the same year still saw around 106,000 victims, so this is a threat that is fading, not gone. Most of them held an ordinary self-custody Solana wallet.
The unsettling detail is that the "connect wallet, approve" motion you perform safely dozens of times is the exact motion the scam hijacks.
What a drainer actually does on Solana
A drainer works by getting one signature that authorizes the attacker to take your assets, rather than by stealing your keys. Once you sign, a program the attacker controls sweeps the wallet in seconds. The whole attack lives inside a single approval, which is why reading that approval is the entire defense.
To see why this is different from a normal transfer, picture what usually happens. When you send someone 5 SOL, you sign a transaction that moves exactly 5 SOL and nothing else. A drainer signature is a different shape: instead of moving one amount, it hands the attacker the right to move your balances, or it changes who owns one of your accounts outright. After that, the sweeping is just cleanup, and it happens too fast to cancel. Security researchers describe drainers as a permission exploit rather than a code exploit, because nothing about Solana was broken. The user was persuaded to grant access (source: Chainalysis's crypto-drainers report).
This is also why two things people rely on do not help here. A hardware wallet protects your private key, but it will still sign a malicious approval if you approve one, because the request looks like any other. And disconnecting the scam site afterward does nothing, because the authority you granted lives on the blockchain, not in the browser tab. Those two misconceptions catch more people than any clever code. So the real question is what that one signature is allowed to authorize.
The signatures that can drain a wallet
Solana lets a single signature grant authority over your tokens or reassign an account, not just move a fixed amount, and drainers use a handful of specific instruction types to do it. Knowing their names turns a scary blur into a short checklist you can actually watch for. Each one shows up differently in your wallet's approval screen, and each has a tell.
The table below covers the ones you are most likely to meet. The mechanics come from Solana's own documentation and from academic analysis of live Solana phishing (source: Solana's Approve Delegate documentation).
| Signature type | What it does | Why it is dangerous | The tell |
|---|---|---|---|
Delegate approval (Approve) | Lets another address move tokens out of one of your token accounts | The delegate can drain that token whenever it wants, later | Prompt names a delegate or "approve" for a token you did not mean to trade |
Owner reassignment (SetAuthority) | Makes the attacker the owner of a token account | Worse than a capped allowance; they own the account, not a limit | Prompt changes an account "authority" or "owner" |
Account reassignment (Assign) | Reassigns a wallet or program account to an attacker's program | Hands broad control to code they wrote | Prompt reassigns an account to an unfamiliar program |
| Durable-nonce pre-sign | A signed transaction that stays valid indefinitely | Lets them show a harmless preview now and execute the real thing later | You "signed" something that seemed to do nothing |
| Blink / Action prompt | A sign request rendered straight from a social post | No website to inspect before you approve | A sign prompt appears from a link or feed, not a site you opened |
Two of these deserve a plain-English word. Owner reassignment, done with an instruction called SetAuthority, is more dangerous than a normal spending approval because it gives away the whole account rather than a limited amount. That distinction is documented in research that traced real Solana phishing transactions (source: the SolPhishHunter research paper). A durable nonce is a legitimate Solana feature that keeps a signed transaction valid with no expiry (source: Solana's durable nonce documentation). Attackers abuse it to separate the moment you sign from the moment the damage lands, which is how a 2026 exploit drained more than $270 million from the Drift protocol by pre-signing transfers that stayed valid for over a week (source: CoinDesk's report on the Drift exploit). These are the weapons. Now here is the bait that gets you to fire one.
How the bait works: fake airdrops, lookalike sites, and blinks
A drainer almost always arrives dressed as a reward you did not earn, because urgency and free money switch off careful reading. The classic form is a fake airdrop: a post or message says you qualify for a token drop, links to a site that looks like a real project, and asks you to connect and claim. The claim button does not check eligibility. It builds a draining signature.
Walk through a typical version, using a made-up but realistic setup. You see a post claiming a JUP airdrop and follow a link to jup1ter-rewards.xyz, a lookalike of a real domain with a number swapped for a letter. The site shows a polished "claim rewards" page and a "Connect Wallet" button that opens the same standard wallet popup you have seen a hundred times. You connect, click Claim, and your wallet asks you to approve a transaction. Because you expected to receive something, you approve without studying it. That single approval was a delegate grant or an owner reassignment, and within one block your SOL, your tokens, and any NFTs are gone. Real victims following this exact pattern have been drained by a single signature they never studied, which is why wallet providers now publish scam guides warning that a legitimate airdrop never asks you to approve an unexpected transaction (source: Phantom's common crypto scams guide).
The delivery keeps getting slicker. Lookalike domains now target almost every popular project, swapping "claim," "rewards," or "airdrop" onto a real brand name. Blinks, a newer Solana feature that turns an on-chain action into a shareable link, let a sign prompt appear straight from a social feed, so there is no website for you to inspect first. And plenty of drains never involve an airdrop at all: a fake support agent, a "verify your wallet" DM, or a spoofed version of a real app such as a Jupiter swap page can carry the same signature. The one constant is that you are asked to approve something. So the moment that decides everything is the approval screen.
How do you spot a drainer before you sign?
The only reliable check is the sign prompt itself, read slowly, every single time. By the time you are looking at a wallet approval, the flashy website and the countdown timer no longer matter. What matters is what the transaction says it will do, and whether it matches what you meant to do.
Run this quick pass before you approve anything:
- Check the URL character by character. Lookalike domains swap a letter for a number or add a word like "rewards." If it is not the project's one official link, stop.
- Read what the transaction grants. A simple purchase should not ask to change an account's "authority" or "owner," or to approve a token you are not trading. If it does, reject it.
- Ask whether you started this. A drain almost always begins with an unexpected reward, an urgent warning, or a stranger's DM. If you did not go looking for it, treat it as hostile.
- Do not trust "it simulated fine" alone. Your wallet's preview is a strong helper, but it is not proof.
That last point needs care, because it is where careful people still get caught. Wallets like Phantom preview a transaction and flag known-bad ones using a security engine and a shared blocklist of malicious sites (source: Phantom's Blowfish acquisition post). That helps a lot, but new scam domains appear faster than blocklists update, and malicious apps can deliberately make a preview show a harmless or empty result. Durable-nonce tricks go further, showing you a clean simulation now while the real transaction executes later. Treat the preview as a smoke alarm, not a force field. Screening the prompt stops the next drain. The approvals you already granted are a separate cleanup job.
How to revoke Solana approvals, and why it is cheap
Revoking an approval removes a standing delegate's right to touch your tokens, and on Solana it costs a fraction of a cent. That is a real advantage over Ethereum, where the same cleanup can cost real money on a busy day. Because it is nearly free, there is no excuse not to audit your approvals every month or so, and immediately after any transaction you are unsure about.
Solana handles approvals a little differently from Ethereum, which is worth one line before the steps.
| Solana | Ethereum | |
|---|---|---|
| Where approvals live | On a token account, one delegate at a time | On the token contract, many spenders possible |
| Cost to revoke | A fraction of a cent | Cents to several dollars when busy |
| Handy extra | Closing empty token accounts refunds ~0.002 SOL rent each | None |
Because a token account holds only one delegate at a time, and a fresh Revoke clears it entirely, cleanup is simple. Here is the native route:
- In Phantom, open Settings, then the token-account or "close empty token accounts" tools, and revoke any delegate you do not recognize.
- In Solflare, open the account's token management screen and revoke delegates the same way.
- To see the full picture, view your wallet on a block explorer such as Solscan and check each token account's delegate field.
- For a bulk sweep, a dedicated revoke tool can list and clear approvals in one flow. Only use one whose exact URL you have verified, and connect nothing until you have.
Revoking a delegate is a normal transaction, so it pays the standard Solana network fee, which rounds to a rounding error. Closing empty token accounts even returns the roughly 0.002 SOL each one held as refundable rent, so a tidy-up can pay for itself. This is also the moment to understand SPL and Token-2022 tokens, since delegates live on those token accounts. From Blofin's operational perspective, a drained wallet usually reaches us as a deposit address that goes silent, followed by a support ticket describing one transaction that swept everything at once. By the time it is reported, the funds have almost always already moved beyond recovery. That receiving-side view is the blunt lesson behind every rule here: prevention at the sign prompt is the whole game, because after the signature there is rarely a second chance.
What if your wallet is already drained?
Move anything that survived to a brand-new wallet immediately, because a wallet that signed a drain may still carry a standing authority the attacker can reuse. Speed matters more than tidiness in the first few minutes, so act first and investigate after.
Work through these steps in order:
- Create a fresh wallet with a new seed phrase, on a clean device if you can, and send any remaining assets there right away.
- Revoke every delegate on the old wallet using the steps above, so no standing approval survives.
- Assume the old seed phrase is burned. Never reuse it, and never enter it into any "recovery" service, which is a common second-stage scam.
- Report the scam site and the attacker's address to your wallet provider and to a scam-reporting service, which can feed blocklists that protect the next person.
Be honest with yourself about recovery. Blockchain transfers are final, and there is no support line that reverses a signed Solana transaction. Reporting helps the ecosystem and occasionally aids an investigation, but you should not count on getting funds back. That hard truth is exactly why the earlier sections matter more than this one, and why a healthy suspicion of unexpected rewards is the cheapest security you own. If you are rebuilding, treat it as a chance to choose a Solana wallet deliberately and to set up Phantom with its security prompts switched on.
Frequently asked questions
Can a drainer take my crypto without my signature?
No. A drainer needs you to approve a transaction; it cannot reach into a self-custody wallet on its own. What makes it dangerous is that the malicious approval is disguised as a harmless one, such as claiming an airdrop or connecting to an app. If you never sign, nothing moves. This is why the single habit of reading every prompt before approving protects you far more than any tool.
Does a hardware wallet protect me from Solana drainers?
Only partly. A hardware wallet keeps your private key offline, so no one can copy it, but it still signs whatever transaction you confirm on the device. If you approve a malicious delegate grant or owner reassignment, the hardware wallet will sign it just as it signs a legitimate one. Hardware protects against key theft, not against approving a bad transaction, so the sign-screen habits in this guide still apply.
Is disconnecting a scam site enough to stay safe?
No, and this catches many people. Disconnecting a site only ends the current browser session; it does not undo any authority you already granted on-chain. If you signed a delegate approval or an account reassignment, that permission stays live until you revoke it, even after you close the tab. Always revoke the approval itself rather than assuming a disconnect fixed it.
How is a wallet drainer different from a memecoin rug pull?
They fail you in different ways. A drainer takes assets you already hold by getting a malicious signature, while a rug pull is a token you bought that collapses when its creators pull liquidity or sell out. A drainer needs one bad approval; a rug pull needs you to hold a bad token. Guidance on the second lives in Blofin's guide to memecoin rug-pull safety, and the broader criminal supply chain behind drainer kits is covered in the overview of how wallet drainers work.
Why did my wallet's preview say the transaction was safe?
Transaction previews are helpful but not foolproof. A malicious app can craft a transaction so the preview shows a harmless or empty result, and durable-nonce tricks can make a preview accurate at signing time while the real damage executes later. Previews and blocklists stop many attacks, but they lag behind brand-new scam domains. Treat a clean preview as one signal among several, not as permission to skip reading the prompt.
Are NFTs drained too, or just tokens?
NFTs are swept in the same attack. On Solana an NFT is a token, so a draining signature that grants control of your token accounts can move NFTs alongside SOL and SPL tokens in one transaction. Keeping high-value NFTs in a separate wallet you rarely connect reduces the risk, and the finer points of NFT approvals are covered in the guide to NFT wallet security.
Researched and written by the Blofin Academy editorial team with AI-assisted drafting. Primary sources include Solana's Approve Delegate documentation, Solana's durable nonce documentation, the SolPhishHunter research paper, Chainalysis's crypto-drainers report, Scam Sniffer's 2025 phishing-loss report, Phantom's Blowfish acquisition post and common crypto scams guide, and CoinDesk's report on the Drift exploit. All facts independently verified against cited documentation current as of July 2026.
This article is for informational purposes only and does not constitute financial advice, investment guidance, or a recommendation to buy, sell, or hold any digital asset. Cryptocurrency markets involve significant risk and you should conduct your own research and consult qualified professionals before making investment decisions. Blofin Academy content reflects the state of public information at time of publication; protocol parameters, fees, and ecosystem data change frequently.