Wallet drainers and fake payment requests: how to spot a malicious Solana transaction.

What is a Solana wallet drainer?

A Solana wallet drainer is a phishing kit: a page or script that asks your wallet to sign something which moves your assets to the attacker, or gives the attacker the right to move them later. It does not break into the wallet. It needs no password and no access to your computer. It needs you to press Approve once.

That one press is final. Solflare's help centre puts it plainly: "Due to the way on-chain transactions on the Solana Network work, a transaction can't be reversed." It goes on: "Meaning that if a token was sent to another account, only that account has the authority to send them back." (Solflare, I got scammed, what should I do?, updated 17 May 2024.)

The FBI's figures show the scale of crypto fraud, though not of drainers alone. Its 2025 Internet Crime Report records 181,565 complaints involving cryptocurrency in 2025 and $11.366 billion in reported losses, 22% more than in 2024. Those figures count every complaint to the IC3 that involved cryptocurrency, and the report does not break drainers out as a category.

How do fake payment requests and drainer sites reach you?

Fake payment requests and drainer sites reach you through links you did not go looking for. Solflare lists the usual routes in its scam article, among them "You went into a scam site that looked very similar to a project's actual website" and "You were offered a free NFT, and when you tried to claim it your assets were stolen."

A fake payment request is the same trap dressed as a bill: a message that says you owe something, or that a payment is waiting for you, with a link to "pay", "verify your wallet" or "claim". The US Federal Trade Commission's guidance on cryptocurrency scams (May 2022) gives two rules that cover most of them: "Never click on a link from an unexpected text, email, or social media message." And: "Don't pay anyone who contacts you unexpectedly, demanding payment with cryptocurrency."

Support impersonation is the third route. Phantom's own safety post (7 October 2021) says "Phantom representatives will never contact you on Twitter, Discord, Telegram or any other chat application." Anyone who asks for your recovery phrase, the 12 or 24 words that restore your wallet, is asking for the wallet itself: whoever holds the phrase can sign anything as you, with no prompt you will ever see.

What does a drainer transaction ask you to sign?

A drainer transaction usually asks for authority over your tokens, not only for a payment. A Solana transaction is a list of instructions, each addressed to a program, and the Token program, the one that holds every USDC balance, has three instructions a drainer wants:

An approval on its own is not proof of theft. Pull subscriptions also run on a delegation, but through a program that fixes the amount per period and the wallets the money may go to; Solana token delegation explained covers how those limits are enforced. What matters is who receives the permission, for how much, and whether you expected to grant one at all. On a one-off purchase you should not be granting any.

Wallets help, within limits. Phantom's safety post explains that it simulates each transaction to preview which assets may move in and out of your wallet, and warns about consequences such as letting others spend your tokens; it also says the simulation is no guarantee. What those wallet warnings mean, and when they appear on harmless requests, is in wallet warnings such as "This transaction may be unsafe".

What does a genuine Fianto payment transaction contain?

A genuine Fianto one-off payment is a transaction Fianto's server builds, your wallet only signs, and Fianto then sends to Solana. It is short enough to read in full. As built, it holds:

1. Two Compute Budget instructions. A compute unit is Solana's measure of the work a transaction may do. One instruction caps the transaction at 60,000 units, the other sets a priority price of 1,000 micro-lamports per unit. They decide the small SOL fee you pay and move no tokens.
2. One TransferChecked of the price from your USDC account to the merchant's USDC account, naming the USDC mint and its 6 decimals. It carries one extra read-only account, a random reference address Fianto uses to find the payment on chain. The Token program ignores it.
3. A second TransferChecked to Fianto, only when the Fianto fee is above zero. There is no Fianto fee during the beta, so today a one-off payment has a single transfer.

You are the fee payer and the only signer. There is no Approve, no SetAuthority, no account closed, and no program other than Compute Budget and Token. After you sign, Fianto checks the signed transaction against what it built and refuses to send it if it calls another program, adds a transfer, or changes the token, the amount or who pays. A wallet may add its own priority-fee instruction, which spends only your SOL, and that passes. Those checks, with their error names, are listed in crypto payment mistakes and how a signed checkout prevents them.

The checkout page tells you what to expect before your wallet opens. Its breakdown, "What you are paying for", lists the amount, the Fianto fee, the Solana network fee ("paid by you, under $0.01") and the Total, and the page says "Paid straight to [merchant name]. Nobody holds it in between." Your wallet's preview should show the Total leaving in USDC and a fraction of a cent in SOL, and nothing else.

A subscription checkout is a bigger transaction on purpose. It creates the subscription on chain with a cap per billing period, pays the first period, and on a wallet's first subscription sets up the USDC permission the program uses. Fianto's charging key signs it as well as you, and pays nothing. The page shows the cap as "Most [merchant name] can charge". What you are approving there is explained in sign message vs sign transaction.

Can a scammer imitate a Fianto checkout?

Yes: anyone can copy the look of a web page, so the design of a checkout proves nothing. A copy hosted elsewhere can ask your wallet to sign any transaction it likes, with Fianto's colours around it, and a lookalike domain is the usual trick. Check two things instead: the exact address in your browser bar, and what the transaction asks your wallet to do.

• Fianto's checkout pages live on checkout.fianto.xyz: a checkout session at /c/ and a payment link at /l/. A Fianto shop lives at <name>.fianto.xyz and sends you to that checkout to pay.
• No Fianto page asks for a recovery phrase or a private key. The checkout asks your wallet for one signature, and the customer portal at fianto.xyz/my signs you in with a message that moves nothing.
• A one-off Fianto payment never asks for an approval or an owner change. If your wallet shows either on what claims to be a one-off Fianto payment, reject it.

A genuine checkout has a limit too. It proves where your money goes, not that the seller will deliver. Fianto reviews and approves each merchant before it can take payments, and Fianto never holds the money, so a dispute is between you and the merchant; there is no chargeback on a USDC transfer.

What should you do if you signed a drainer transaction?

What to do after signing a drainer transaction depends on what you signed, so work out which of these happened first:

You approved a delegate

Revoke it from the same wallet as soon as you can: until you do, the delegate can spend up to the approved amount whenever it chooses. Solana's docs note that "A token account stores one current delegate and one delegated amount at a time." The steps, wallet by wallet, are in how to see and revoke token approvals on Solana.

You typed or pasted your recovery phrase

Treat the wallet as lost. Revoking approvals does not help, because the attacker can sign as you. Create a new wallet with a new phrase and move whatever is left to it, starting with the most valuable tokens.

Tokens already left the wallet

They will not come back through the network. The FTC's page lists where to report: ReportFraud.ftc.gov, the CFTC, the SEC, the FBI's IC3, and the exchange you used to send the money. Ignore anyone who offers to recover the funds for a fee: securing the wallet you get paid to explains why such recovery is not something the chain allows.

If the request used Fianto's name and you are unsure whether it was real, check the link's address against the list above before you pay, and contact Fianto through Get help in the payer docs. A merchant you buy from can also confirm whether it sent you a payment link.