Drainers, fake airdrops, address poisoning and impersonators
The scams that skip the coin and go straight for your wallet, and the habits that stop most of them.
Everything so far needs you to buy a bad coin. The scams in this lesson do not. They go straight for your wallet, and most of them need just one thing from you: a signature, your seed phrase, or an address you pasted without checking.
Drainers and phishing
A drainer is code on a fake website that asks your wallet to sign a transaction. The page looks like a mint, a claim, a swap or a wallet check. You approve, and within seconds your tokens and SOL move to the attacker. On Solana one signature can empty a wallet.
Some are sneakier. In late 2025 the security firm SlowMist reported a Solana victim who signed a transaction whose prompt seemed to show no balance change at all. It quietly made the attacker the owner of the wallet's account, and more than $3 million was drained.
Fake airdrops
You open your wallet and find a token or NFT you never bought, promising free money at some website. This is bait, and the website is a drainer. Over the winter of 2023 to 2024, one drainer gang airdropped NFTs to holders of a Solana coin, offering 1,000 free tokens to anyone who claimed them. The security firm Scam Sniffer counted about $4.17 million stolen from 3,967 Solana wallets by that gang and a second one that spread its links through Discord and hacked X accounts. Phantom's advice is blunt: assume any token or NFT you did not ask for is a scam, and never click its links. Hide it and move on.
Address poisoning
Solana addresses are long, so wallets show only the first and last few characters. Attackers use that. They make an address that starts and ends like one you use, then send you a tiny transfer from it. Now the fake sits in your history, right next to the real one, waiting for you to copy the wrong line.
A real one: the $10 test that passed
On November 17, 2025, a Solana wallet sent $10 of USDT to its own exchange deposit address. Twelve seconds later, a lookalike address sent it a tiny dust transfer. The owner then sent another $10 as a test, this time to the lookalike, and it went through fine. Then they sent 30,749.80 USDT to the same lookalike.
The test passed because the fake was a real address. A test proves money arrived somewhere, not that it arrived at the right place. The data firm Bitquery counted about 4.5 million Solana wallets targeted by poisoning between late October 2025 and early October 2026.
Impersonators
- Fake support. You post a problem and someone DMs you from 'support'. Phantom says to reach its support only from inside the app, never to follow links in support messages you did not ask for, and that its team will never ask for your seed phrase.
- Fake accounts and copycat coins. A lookalike X account replies under a famous trader with a contract address. Anyone can launch a coin with any name and picture. Only the contract address, from a source you trust, tells you which coin is which.
- Fake bots. A Telegram 'verification' bot asks you to paste a command into your computer to join a group. Since late 2024 this has been used to install wallet-stealing malware. A 'new version' of a trading bot asks for your private key. Both are theft.
- Hacked friends. A friend's account sends you a link. Phantom's advice covers this too: do not click links in DMs, even from people you know.
Check what you learned
0 of 5 answered
Finished reading? Tick it off and your progress is kept in this browser.
This guide is for learning. It is not financial advice. Most memecoins go to zero and most people who trade them lose money. Only ever trade what you can afford to lose.