Security: keep your wallet safe

Solana's code is rarely what drains people. People are. Almost every loss comes from someone being tricked into revealing a recovery phrase or signing a transaction they didn't understand. The good news: a handful of habits stop nearly all of it.

The scams that actually work

Fake claim and mint pages. A copy of a real site (or a brand-new "airdrop") asks you to connect and sign. The transaction transfers your tokens, NFTs or SOL to the scammer. These spread through replies, DMs, sponsored search results and spam tokens in your wallet with links in their names.

Recovery phrase phishing. "Your wallet is compromised, verify here." "Validate your wallet to receive the airdrop." Fake support on Discord or Telegram. Anything that asks for your phrase is stealing your wallet.

Address poisoning. Scammers send you a tiny transfer from an address that starts and ends like one you use, hoping you copy it from your history next time. Always copy addresses from saved contacts, and check the middle characters too.

Malicious approvals. Some transactions give a program ongoing permission over a token account, or change who owns an account. Wallet previews flag many of these; take warnings seriously.

Fake apps and extensions. Lookalike wallet apps in stores and malicious browser extensions that read your clipboard or pages.

Habits that stop almost everything

1. Read every wallet preview. Phantom and Solflare simulate transactions. If assets you didn't expect are leaving, reject.
2. Bookmark the apps you use. Don't reach them through search ads, replies or DMs.
3. Split wallets. A vault for savings (ideally hardware) and a daily wallet for new apps.
4. Never share your phrase. Not with support, not with a site, not with a "validator".
5. Be suspicious of urgency. "Claim in 10 minutes" is a pressure tactic.
6. Ignore spam tokens. Don't open links in token names; hide or burn them.
7. Keep software updated and install wallets only from official sources.

If something goes wrong

Act fast. Create a new wallet with a new recovery phrase on a clean device, and move whatever's left immediately. Don't reuse the compromised phrase. Revoke suspicious permissions if your wallet shows them. Then look up the transaction on Solscan to understand what happened. Recovery services that DM you promising to get funds back are almost always a second scam.

For larger balances

• A hardware wallet connected to Phantom or Solflare.
• A multisig (Squads) for shared or business funds, so one compromised key isn't enough.
• Keep a written plan for heirs or partners: where the phrase is and how to use it.

Security checklist

• My recovery phrase is on paper or metal, offline, nowhere digital.
• I bookmark apps and never use links from DMs, replies or ads.
• I keep savings in a separate wallet, ideally hardware.
• I read the wallet preview before every signature.
• I copy addresses from contacts, not recent history.
• I ignore "support" that messages me first.
• I check mint addresses and authorities before buying new tokens.
• I never sign on sites offering tokens I didn't expect.