Phantom malicious dApp warnings: what they mean and what to do
Phantom shows a warning when a site is on its blocklist, when a domain is new or unreviewed, or when it cannot simulate what a transaction will do. The safe default is to stop, close the tab and reach the site again from a trusted bookmark. Legitimate new apps can trigger warnings too, but you should only proceed if you are certain the site is real and you understand what you are signing.
Quick steps
- Reject the request. Click reject or close the Phantom window; nothing happens until you sign.
- Check where the link came from. Treat links from DMs, replies, search ads and claim emails as suspicious.
- Compare the address. Look for extra letters, hyphens, a different ending or look-alike characters in the site address.
- Return via a bookmark. Open the project from an address you type yourself or a saved bookmark and see if the warning remains.
- Disconnect and revoke. If you connected, remove the site under Settings, Connected Apps and revoke any EVM token approvals.
- Act fast if funds moved. If you signed and lost funds, move what is left to a new wallet created on a clean device.
Phantom checks sites and transactions before you sign. It acquired the security firm Blowfish, whose technology powered its transaction previews, in November 2024, and it also uses third-party providers such as Blockaid for token checks (Phantom blog, 2024; Phantom developer docs, 2026). Its warnings are not perfect, but drainer sites rely on people clicking past them. Most stolen funds in Phantom wallets come from signing something malicious, not from Phantom being hacked.
The warnings and what they mean
| Warning text | Why it appears | What to do |
|---|---|---|
This domain is new or has not been reviewed yet. Proceed with caution. | Phantom has not reviewed the site yet. Phantom says it normally clears within a few days for legitimate sites. | Double-check the address against a trusted source. Wait if in doubt. |
This dApp could be malicious. Do not proceed unless you are certain it is safe. | Phantom could not simulate the transaction reliably before it is sent, so it cannot show you what will change. | Do not sign unless you fully trust the site and understand the transaction. |
Request Blocked – dApp May Be Malicious | Phantom blocked the request as likely malicious. | Treat the site as a drainer. Close it. |
| Full-page blocklist warning | The address is on Phantom's public blocklist of malicious URLs. | Leave the site. Do not click through. |
This app's identity could not be verified. It may be impersonating another app. | On Android, an app asking to connect could not prove it is who it claims to be. | Reject and uninstall apps you did not get from the official store. |
This transaction will burn a valuable prediction market token. Please use the Phantom app to close the position first. | A transaction would destroy a prediction market position token. | Reject it and close the position inside Phantom. |
Sources: the first, second, fifth and sixth texts are from Phantom's developer docs page on domain and transaction warnings (2026); the third is the wording developers have reported on Phantom's GitHub (2025).
"This dApp could be malicious" in detail
Phantom's help centre explains that this warning appears when Phantom cannot accurately simulate a transaction before it is sent, for example because the transaction behaves in a dynamic or non-standard way (Phantom help centre, 2026). Simulation is what normally lets Phantom show "you will send X and receive Y". Without it, you are signing blind.
That does not prove the site is malicious. But drainers deliberately build transactions that are hard to simulate, and blind signing is exactly what they want. Phantom's advice is to proceed only if you fully trust the app and understand the risks, and to stop and research it if you are unsure.
How Phantom's blocklist works
Phantom maintains a public blocklist of malicious URLs on GitHub. According to the repository, the extension stores the list locally and checks addresses on your device, so Phantom does not collect your browsing data. New entries reach users in under 15 minutes. If you visit a listed site, Phantom redirects you to a warning page; a connect request from a listed site shows a warning on the connection screen (Phantom blocklist repository, 2026).
You can click through, and Phantom will then remember that site as allowed on your device. That is why clicking through on a whim is risky: you switch off the protection for that site from then on.
What to do when you see a warning
- Reject the request. Nothing happens until you sign, so rejecting is always safe.
- Check how you got there. Links in DMs, replies on X, Discord announcements, search ads and "claim" emails are the main routes to drainers. Fake airdrop and "Phantom token" sites are common; there is no Phantom token.
- Compare the address. Look for extra letters, hyphens, a different ending or look-alike characters. Our link checker catches common look-alike tricks for Phantom's own domains.
- Return through a trusted route. Type the project's address yourself or use a bookmark you saved earlier, then see whether the warning is still there.
- If you already connected, disconnect the site under Settings, Connected Apps, and on EVM networks revoke any token approvals you gave.
- If you already signed and lost funds, follow what to do if your wallet was drained immediately.
False positives: when a real site is flagged
New or small projects do get flagged. The new-domain warning is shown automatically for sites Phantom has not reviewed and usually clears in days. The "could be malicious" warning can come from how a legitimate app builds its transactions. Developers have reported on Phantom's GitHub that blocked requests cleared after about a week, and Phantom staff pointed them to [email protected] (Phantom GitHub discussion, 2025).
As a user, you cannot tell a false positive from a real drainer by looking at the site. Copies of real dApps look identical. A useful rule: if the project is genuine, waiting a few days costs you little; if it is a drainer, clicking through can cost everything.
If you run the flagged site
Phantom's developer docs describe the causes and fixes. For the simulation warning, Phantom recommends simpler transactions that are easier to simulate (with explicit compute and account-data limits and, where possible, a single signer), letting Phantom sign and then submitting through your own RPC with preflight checks. If a warning persists, Phantom's docs point to a domain review request form; for Android identity warnings, they point to a correct Digital Asset Links file. Phantom's GitHub replies have also referred developers to [email protected] (Phantom developer docs, 2026).
Things that are always red flags
- A site, pop-up or "support agent" asking for your recovery phrase or private key. Phantom never asks for it.
- A pop-up claiming Phantom needs an urgent "update" or "verification" through a website. Updates come only from the official store.
- A message that you must "validate", "sync" or "rectify" your wallet.
- Anyone telling you to ignore Phantom's warning because "it is a bug".
For the bigger picture, read is Phantom wallet safe and fake Phantom wallet scams.
Frequently asked questions
Does the warning mean the site is definitely a scam?
No. It means Phantom found a risk or could not check the transaction. But real drainer sites look exactly like genuine ones, so the safe choice is to stop and verify.
Why does a new legitimate dApp get flagged?
Phantom shows a new-domain warning for sites it has not reviewed, and it usually clears within a few days. Transactions that are hard to simulate can also trigger warnings.
What happens if I click through a blocklist warning?
Phantom adds the site to an allow list on your device and stops redirecting you there, so you lose that protection for the site from then on.
I signed after seeing the warning. What now?
Check your wallet on an explorer. If anything moved, follow the drained-wallet steps at once. If nothing moved, disconnect the site and revoke EVM approvals.
How do developers get a site reviewed?
Phantom's developer docs point to a domain review request form, and Phantom staff have referred developers to [email protected].