Solana wallet security in 2026: the full checklist (with real drainer examples)

Published 2026-09-29 · 8 min read

Solana wallet security in 2026: the full checklist (with real drainer examples)

Solana's UX makes it easy to sign transactions — sometimes too easy. Drainer contracts, phishing sites, and rogue tools have drained thousands of wallets since 2022. This guide is a practical checklist to protect your Solana wallet in 2026, with concrete examples of what attackers actually do.

The threat landscape

Solana wallet loss patterns in 2024-2026: - ~65% — seed phrase phishing (fake support DMs, fake wallet update pages) - ~20% — malicious signature (user signs a SetAuthority or TransferAll disguised as something else) - ~10% — drainer sites hidden behind legitimate-looking URLs (typo-squatting) - ~5% — infected wallet software (fake Phantom extensions from unofficial stores)

None of these attacks exploit Solana itself. They exploit the user.

The 8-step security checklist

1. Only install wallets from official sources

Never install a Solana wallet from a link in Discord, Telegram, or an email. Chrome Web Store has had malicious fake Phantom extensions removed multiple times.

Bookmark the official pages. Only reinstall from bookmarks.

2. Seed phrase — write it down, never digitize

Your 12/24-word seed phrase is the master key. Anyone with it owns your wallet forever.

Rules: - Write it on paper (or metal for durability) - Store in ≥2 physical locations you control - Never photograph, screenshot, email, text, cloud-store, or paste it anywhere digital - Never enter it on any site that isn't your wallet's official recovery page

Red flag: any site asking for your seed phrase is a scam. Full stop. Real dApps only need a wallet connection + signature, never seed.

3. Use a hardware wallet for holdings > $500

Ledger Nano X or S+ with the Solana app. Trezor Safe 3 with third-party Solana support (fide.eco, though the ecosystem is smaller).

Hardware wallets require physical button confirmation for every signature. Even if malware infects your computer, they can't sign without you pressing OK on the device.

For active trading you'll want a "hot" wallet with small amounts. Move everything else to cold storage.

4. Read what you're signing

This is the hardest one. Modern drainers use transactions that LOOK like normal swaps but include a hidden instruction that transfers your assets to the attacker.

Phantom and Solflare show every instruction before you sign. Read them: - Legitimate swap shows: TokenSwap.swap + your ATAs + reasonable amounts - Drainer shows: TokenTransfer of ALL your holdings to an unfamiliar address

If you see a TransferAll, SetAuthority, or CloseAccount to an address you don't recognize — REJECT.

5. Beware "verify your wallet" DMs

Common scam: "You've been randomly selected for our Solana airdrop! Verify your wallet at solana-airdrop.xyz"

Any DM you didn't ask for = ignore. Any airdrop announcement in a DM = ignore. Legitimate airdrops publish claim pages on official project sites, never in DMs.

6. Typo-squatting URLs

Real: jup.ag, phantom.com, raydium.io, solscan.io, solduster.com Scams (real examples seen 2024-2026): - jup-ag.com - phantom-wallet.io - raydiuum.io - solscann.io - soldusterr.com

Always navigate to Solana sites via bookmarks or direct-typed URLs, never via search results (SEO poisoning is real) or Discord links.

7. Revoke unused permissions

Every dApp you've ever connected has a "connection" stored in your wallet. Some retain the ability to prompt you for future signatures.

Periodically (once a month): - Phantom: Settings → Trusted Apps → revoke everything you don't actively use - Solflare: same idea under Settings → Connected Sites - Backpack: Settings → Privacy → Connected Apps

Also check on-chain token allowances via https://revoke.cash — for any lingering approvals to old dApps.

8. Use safe tools for cleanup

Tools that "recover" your SOL or "clean" your wallet should be non-custodial: the signature request should show CloseAccount instructions to accounts YOU own, with destination = your own wallet.

Legitimate tools: - SolDuster — non-custodial, source of every instruction verifiable - jup.ag/close — Jupiter's built-in - sol-incinerator.com — well-known standalone

Never trust a tool that: - Asks for seed phrase - Requests unusual permissions (SetAuthority, Delegate) - Runs closed-source on a shady domain

For SolDuster specifically, the recovery transaction shows exactly what you're signing: - closeAccount instructions for empty ATAs you own - Destination = your main wallet - No transfers, no SetAuthority, no third-party addresses

If the wallet UI shows anything else during a "recovery" prompt, don't sign.

Real drainer examples we've seen in 2026

Example 1: Fake pump.fun cashback page - URL: pumpfun-cashback.com - Prompts wallet connect, then a signature "to claim your cashback" - Actual instruction: SetAuthority transferring ownership of ALL your token accounts to the attacker - Users signed because "pump.fun cashback" was a real (retired) program

Example 2: Fake wallet migration - Email/DM: "Phantom is migrating to v3, please migrate your wallet" - Link: phantom-migrate.io - Prompts seed phrase entry - Loss: total wallet drain within minutes

Example 3: Malicious Solana Jupiter alternative - URL: jupiter-swap.io (not real Jupiter) - Fake swap UI, prompts a signature - Actual instruction: swap 10 USDC to $1 memecoin, then TransferAll of all remaining tokens - Loss: user thought they lost 10 USDC on a bad swap, actually lost everything

The one rule that would prevent 90% of losses

Read the transaction before you sign it. Not the button text ("Claim"), but the actual instruction list Phantom/Solflare shows below.

If you see a destination address that isn't yours, or an instruction you don't understand, cancel.

Follow @SoldusterHQ for updates on Solana security and best practices.

Scan your wallet on solduster.com →