Jack, a Solana crypto enthusiast using the Phantom wallet, fell victim to a sophisticated “ cryptodrainer ” scam , losing $9,000 from his wallet almost instantly
See also: Malicious Chrome extension introduces hidden SOL fees into Solana transactions
As he told Cybersecurity News, the incident began with a tempting Instagram ad promising quick profits that led him to a fake website. There, a deceptive notification convinced him to approve a transaction with the promise of receiving money, when in reality malicious JavaScript, specifically “SkyDrainer.js,” emptied his wallet. The website disappeared shortly after the transaction, leaving the user shocked but determined to investigate. Using Google dorking techniques, he found the drainer openly advertised on underground forums, such as Cracked[.]sh and the Russian hacking platform LolzTeam.
A post on Cracked[.]sh promotes the “Supreme #1 Solana Drainer,” offering free access via Telegram bots with features such as the best bypass methods, free hosting, no warnings, obfuscation, and a low 10% rate, much lower than competitors.
See also: Wind farm worker turned turbines into secret crypto-miner
Access to the Telegram bot revealed a disturbing set of ready-made tricks, designed to avoid suspicion. Screenshots show options such as “Cracher,” which “drops” the approval window to hide the results of the transaction; “Fake Gain,” which displays fake green alerts for incoming SOL or USDT; and “Fake Return,” which pretends that funds are being withdrawn and returned.
In the Phantom wallet settings within the bot, there are even options to enable fake protection messages and profit notifications, making the scam look completely legitimate. Jack showed how easy it is to deploy such tools: within 3–4 clicks – choosing a template, connecting nameservers and specifying a wallet address – a fully functional malicious website, identical to the attacker’s, was created. No technical knowledge is required, allowing anyone to launch an attack in less than a minute.
See also: Ethereum Wallet emerges as a serious threat
Solana drainers are on the rise, with reports of campaigns that have siphoned off millions through similar phishing attacks on social media and fake dApps.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
