Search tracked domains and review stored evidence, detections, and the latest observed availability.

Total Tracked

CRITICAL THREAT

Understanding and Combating Solana Drainer Threats

Solana Drainer threats pose a critical risk with 1,323 domains tracked and 184 currently active. PhishDestroy insights reveal top TLDs and registrars involved.

2,625

Domains Detected

CRITICAL

Threat Level

How This Attack Works

Solana Drainer threats exploit vulnerabilities in Solana's crypto ecosystem to steal funds. Understanding their operation is crucial for prevention.

STEP 1

Target Identification

Attackers identify potential victims through phishing emails and fake websites.

STEP 2

Phishing Execution

Victims are lured to malicious sites mimicking legitimate platforms, like phantomairdrop.com.

STEP 3

Credential Harvesting

Once on the fake site, victims input sensitive information, believing it to be secure.

STEP 4

Fund Drainage

Attackers utilize harvested credentials to access wallets and drain funds via illicit transactions.

Technical Analysis

Solana Drainer attacks leverage phishing techniques to exploit the Solana blockchain. Attackers often create copycat websites using top TLDs such as .com, .xyz, and .cc, with domains hosted by registrars like Cloudflare, Inc. and PDR Ltd. These sites employ deceptive JavaScript and HTML code to mimic legitimate interfaces, tricking users into entering their private keys or seed phrases. Once credentials are obtained, attackers interact with the Solana blockchain via RPC calls to execute unauthorized transactions. The usage of smart contract functions like `transfer` and `approve` allows attackers to swiftly move funds out of victims' accounts. The infrastructure often involves a network of proxy servers to obfuscate the origin of the attack and make tracing back to the perpetrators difficult.

Real Cases

Phantom Wallet Breach (2023)

$2 million stolen

Attackers created a fraudulent Phantom wallet site to harvest user credentials, resulting in a $2 million theft.

SolUnion Scam (2024)

$1.5 million stolen

Using the domain phantom.solunion.cc, scammers executed a sophisticated phishing attack, stealing $1.5 million in SOL.

VaultBenefits Exploit (2024)

$3 million stolen

A fake airdrop campaign via vaultbenefits.net led to credential compromise and a subsequent $3 million drain.

How to Detect

Unsolicited emails or messages offering free SOL or airdrops

Websites with slight misspellings of legitimate names

Requests for private keys or seed phrases

Suspicious URL structures or unfamiliar TLDs like .xyz or .cc

Lack of HTTPS security on sites claiming to be secure

How to Protect Yourself

1 Verify URLs carefully before interacting

2 Enable multi-factor authentication on your wallet

3 Never share your private key or seed phrase

4 Regularly check transaction histories for unauthorized activity

5 Use official wallet apps and browser extensions

Frequently Asked Questions

What is Solana Drainer?

Solana Drainer refers to phishing attacks targeting Solana wallet users to steal funds by tricking them into revealing sensitive credentials.

How much money has been stolen through Solana Drainer?

Millions have been lost, with notable cases like the Phantom Wallet Breach resulting in a $2 million loss.

How do I protect myself from Solana Drainer?

Stay vigilant by verifying URLs, using multi-factor authentication, and never sharing your private keys.

What should I do if I'm a victim of Solana Drainer?

Report the incident to authorities and your wallet provider immediately, and attempt to trace unauthorized transactions.

Data sourced from PhishDestroy threat intelligence database — 2,625 domains tracked for this threat type

Solana Drainer — Threat Intelligence Smart Contract Active Threat

solana.com (official)

2,625

Domains

414

Alive

2,206

Taken Down

5.5

Avg VT

15.8%

Alive Rate

93.3%

Detected

Since Mar 2024 1,093 domains with VT ≥ 5

Solana Drainer 2,625 domains