Phantom wallet drained or hacked: what to do now
If funds left your Phantom wallet without your approval, assume your recovery phrase or a signed approval is compromised. On a clean device, create a brand-new wallet with a new recovery phrase and move anything left into it, then revoke approvals, report the theft and ignore anyone offering to recover funds for a fee.
Quick steps
- Stop using the compromised wallet. Do not sign anything else with the drained wallet and do not import its recovery phrase anywhere new. If you installed an app or extension from a link, remove it.
- Create a new wallet on a clean device. On a device you trust, install Phantom from the official store listing and create a new wallet with a new recovery phrase. Do not restore the old phrase. Write the new phrase on paper.
- Move what is left. From the old wallet, send remaining tokens and NFTs to the new wallet's addresses, starting with the most valuable. Keep a little SOL or ETH for fees, and check each address in full.
- Revoke approvals and connections. Remove connected sites in Phantom's settings. On EVM networks, check and revoke token approvals for the old address with a block explorer's approval checker.
- Record the evidence. Save the attacker's address, transaction IDs from a block explorer, dates, and screenshots of the site, app or messages involved.
- Report it. Report to your local police or national cybercrime service, and to Phantom through the in-app chat. If stolen funds reached an exchange, contact that exchange's support with the transaction IDs.
- Ignore recovery offers. Anyone who contacts you offering to recover the funds for a fee is a scammer. Private recovery firms cannot seize crypto.
Finding your wallet empty is frightening. Act quickly but calmly: the attacker may still be watching the wallet and can take anything new that arrives. This guide covers what to do in the next hour, how drains usually happen, and what does not work. We are an independent guide; we are not Phantom and cannot help you recover funds.
First: work out which kind of compromise it is
| What happened | What the attacker has | Is the old wallet still usable? |
|---|---|---|
| You typed your recovery phrase into a site, app, form or "support" chat | Full control of every account from that phrase, on every network | No. Abandon it. |
| You installed a fake Phantom extension or app and created or imported a wallet in it | Your recovery phrase | No. Abandon it. |
| You signed a transaction on a site and it took your tokens | Whatever that transaction sent; on EVM, possibly ongoing approvals | Possibly, after revoking. A new wallet is still safer. |
| You sent funds to an address copied from your history or a chat | Only that transfer (address poisoning) | Yes. Your keys are not compromised. |
| Funds vanished and you do not know why | Assume the recovery phrase | No. Abandon it. |
If you are not sure, treat it as a leaked recovery phrase. A phrase leak affects every account derived from it: Solana, EVM and Bitcoin addresses, and any extra accounts you created in Phantom.
Why a new wallet on a clean device matters
Some drains come from malware that reads what you type or what is on your screen. If you create the new wallet on an infected computer, the attacker can take the new phrase too. Use a phone or computer you trust and that has not run the suspicious app, file or extension. If you have a hardware wallet, creating the new wallet on it (for example a Ledger paired with Phantom) is even better; see Phantom with Ledger.
Install Phantom only from the official listing: type phantom.com yourself or check the listing with our download checker. Then follow how to set up Phantom and create a new wallet. Do not restore the old phrase in the new install.
Moving what is left
- Fees first. You need SOL to move Solana tokens and ETH, BNB or another native coin to move tokens on EVM networks. If the attacker took all your SOL, a small amount sent to the old wallet may be swept immediately by an automated script. Move the most valuable assets first, as fast as you can.
- Staked SOL. Native stake accounts cannot be moved instantly. Unstaking takes about two to three days. Attackers with your phrase can do the same, so it becomes a race; start unstaking straight away.
- Check every address. Copy addresses from the new wallet itself, not from your history, which may contain poisoned look-alikes. Our address checker compares them.
- Spam tokens. Leave them. Interacting with them can lead to another drainer.
Revoking access
Disconnecting a site in Phantom's settings stops it from seeing your address and asking for signatures, but it does not undo anything already signed. On EVM networks such as Ethereum, Base, Polygon and BNB Chain, a signed token approval lets a contract keep moving that token until you revoke it. Block explorers such as Etherscan offer a token approval checker for this; each revoke costs a small network fee. If the recovery phrase leaked, revoking does not help: the attacker can simply sign new transactions, which is why you move funds out.
How drains usually happen
- Leaked recovery phrase: fake Phantom downloads, fake support chats, fake "update" or "sync" pop-ups, phrases stored in screenshots or cloud notes.
- Malicious signatures: fake airdrops, mints and token claims that ask you to approve a transaction moving your assets. See Phantom's malicious dapp warnings.
- Address poisoning: funds sent to a look-alike address copied from your history or from a chat message. Technically not a hack, but the result is the same.
- Malware: infected downloads, cracked software or fake "trading bots" that read your keys or clipboard.
More detail and examples are in fake Phantom scams. If you are not sure whether something you signed was harmful, our signature explainer can help with EVM approvals and sign-in messages.
What does not work
- Recovery services. The FBI warned in August 2023 that private recovery companies cannot issue seizure orders for crypto, and that fake recovery firms charge upfront fees and disappear (FBI, 2023). People who contact you after a public post about your loss are scammers, whatever they call themselves.
- Phantom "reversing" the transaction. Phantom is self-custody and cannot reverse, freeze or refund blockchain transactions. Nor can Solana or any other network.
- Phone support. Phantom has no phone line and never contacts users first. Numbers that claim to be Phantom support are run by scammers; see the Phantom support phone scam.
- Paying the attacker. Messages offering to return funds for a payment are another scam.
Reporting the theft
Recovery is rare, but reports help investigators link cases and are sometimes needed for tax purposes. Report to your local police and your national cybercrime service. In the US that is the FBI's Internet Crime Complaint Center (ic3.gov). In England, Wales and Northern Ireland it is Report Fraud (reportfraud.police.uk), which replaced Action Fraud in December 2025; in Scotland, contact Police Scotland on 101. Include the attacker's address and the transaction IDs. If the funds moved to a centralised exchange, contact that exchange with the same details; exchanges can freeze accounts through their own processes or legal requests (FBI, 2023). Also tell Phantom through the chat in the real app so the site or app involved can be blocklisted. Phantom's support works in English and follows up by email.
Afterwards
Keep your new recovery phrase on paper or metal, offline. Use a separate wallet with small amounts for new apps and keep savings in a wallet you never connect to unknown sites. Read how to protect your Phantom recovery phrase and Is Phantom Wallet safe?
Frequently asked questions
Can Phantom refund stolen crypto?
No. Phantom is a self-custody wallet and cannot reverse, freeze or refund blockchain transactions. Anyone claiming to be Phantom and offering a refund is a scammer.
Can I keep using my old recovery phrase after a drain?
No. If there is any chance the phrase leaked, every account derived from it is compromised. Create a new wallet with a new phrase on a clean device.
The attacker keeps taking the SOL I send for fees. What can I do?
Automated scripts often sweep incoming SOL from compromised wallets. Send only what is needed for one transaction at a time and move the most valuable asset first, or accept the loss of what remains.
Will reporting to the police get my funds back?
Rarely, but it is still worth doing. Reports help investigators connect cases, and an exchange is more likely to act on a report with transaction IDs.
Someone says they can trace and recover my crypto. Should I pay?
No. The FBI warns that private recovery firms cannot seize crypto and that many are scams aimed at people who have already lost funds.