{"id":8954,"date":"2025-12-05T10:03:33","date_gmt":"2025-12-05T10:03:33","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/05\/beware-of-solana-phishing-attacks-that-let-hackers-initiate-unauthorized-account-transfer\/"},"modified":"2025-12-05T10:03:33","modified_gmt":"2025-12-05T10:03:33","slug":"beware-of-solana-phishing-attacks-that-let-hackers-initiate-unauthorized-account-transfer","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/05\/beware-of-solana-phishing-attacks-that-let-hackers-initiate-unauthorized-account-transfer\/","title":{"rendered":"Beware of Solana Phishing Attacks That Let Hackers Initiate Unauthorized Account Transfer"},"content":{"rendered":"<p>    Beware of Solana Phishing Attacks That Let Hackers Initiate Unauthorized Account Transfer<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p>A dangerous new wave of phishing attacks is targeting Solana users by changing wallet ownership permissions rather than stealing private keys.<\/p>\n<p>A victim lost more than USD 3 million in a single attack, with an additional USD 2 million locked in investment platforms.<\/p>\n<p>What makes this attack unique is that the user\u2019s funds remained visible but became impossible to move or control.<\/p>\n<p>The attack works in two surprising ways. First, when users approve a transaction, wallets show the wallet balance to help users feel safe.<\/p>\n<p>Attackers craft special transactions that appear harmless because they cause no visible balance changes.<\/p>\n<p>Second, unlike other blockchains like Ethereum where ownership is locked to your private key, <a href=\"https:\/\/cybersecuritynews.com\/ethereum-vs-solana-a-comprehensive-comparison-of-eth-and-sol\/\" target=\"_blank\" rel=\"noreferrer noopener\">Solana<\/a> allows wallet owners to be reassigned through a technical operation.<\/p>\n<p>This difference leaves many users unprepared for such attacks. SlowMist security analysts <a href=\"https:\/\/slowmist.medium.com\/beware-of-solana-phishing-attacks-wallet-owner-permissions-may-be-altered-708bbb30518e\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">identified<\/a> and studied this emerging threat after a user reached out for help.<\/p>\n<figure class=\"wp-block-embed aligncenter is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-twitter\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/s.w.org\/images\/core\/emoji\/17.0.2\/72x72\/1f6a8.png?ssl=1\" alt=\"\ud83d\udea8\" class=\"wp-smiley\" style=\"height: 1em; max-height: 1em;\">Beware of Solana <a href=\"https:\/\/twitter.com\/hashtag\/Phishing?src=hash&amp;ref_src=twsrc%5Etfw\">#Phishing<\/a> Attacks: Wallet Owner Permissions Can Be Altered<\/p>\n<p>1\u20e3Recently, we assisted a victim of a phishing attack that resulted in the unauthorized transfer of his account\u2019s Owner permission. This is similar to the &#8220;malicious multisig&#8221; \u2013style attack commonly\u2026 <a href=\"https:\/\/t.co\/7yO1uAJT5a\">pic.twitter.com\/7yO1uAJT5a<\/a><\/p>\n<p>\u2014 SlowMist (@SlowMist_Team) <a href=\"https:\/\/twitter.com\/SlowMist_Team\/status\/1996528328061382860?ref_src=twsrc%5Etfw\">December 4, 2025<\/a>\n<\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/div>\n<\/figure>\n<p>Upon on-chain investigation, the researchers discovered that the attacker had already transferred the account Owner permission to a different wallet address.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjx7UtWScGaqf-MO_B2J7b5jsnx7AO_F7jMuwgTyu048GGTDPXPJsEvv7ZMOs5JDivv0mXIyT1dDUhYa9DnM5GR5fw5yiWs1NxqK-Hr9Qdy6mCbbgjOC4nDDdVCa9geq1PzDOH2J6BwT-6tbzGhdDPRWTNnCaYiALWEdrqU2msNAZN-C07xmalWj90zhi4\/s16000\/Victim%2520attempted%2520to%2520initiate%2520a%2520transfer%2520from%2520the%2520compromised%2520account%2520to%2520their%2520own%2520address%2520to%2520verify%2520control%2520%28Source%2520-%2520Medium%29.webp?ssl=1\" alt=\"Victim attempted to initiate a transfer from the compromised account to their own address to verify control (Source - Medium)\"><figcaption class=\"wp-element-caption\">Victim attempted to initiate a transfer from the compromised account to their own address to verify control (Source \u2013 Medium)<\/figcaption><\/figure>\n<\/div>\n<p>This meant the victim could not move funds, remove approvals, or use their assets in decentralized finance platforms, despite still owning them.<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-understanding-the-technical-mechanism-behind-account-ownership-changes\"><strong>Understanding the Technical Mechanism Behind Account Ownership Changes<\/strong><\/h2>\n<p>The core of this attack centers on Solana\u2019s account model. When you create a wallet, its Owner is typically the system program, which acts as a default security authority.<\/p>\n<p>Solana systems use this Owner field to verify that transaction requests come from legitimate signers.<\/p>\n<p>SlowMist security researchers noted through technical analysis that the attackers exploited the \u201cassign\u201d instruction, a built-in Solana command that can change an account\u2019s Owner field.<\/p>\n<p>The instruction takes a simple form: it specifies which account to reassign and identifies the new owner.<\/p>\n<p>When victims unknowingly approve transactions containing this instruction, they essentially sign away control of their <a href=\"https:\/\/cybersecuritynews.com\/malicious-npm-packages-attacking-ethereum-wallets\/\" target=\"_blank\" rel=\"noreferrer noopener\">wallets<\/a>.<\/p>\n<p>The reassignment happens quietly without causing any token balance changes, making detection extremely difficult for average users.<\/p>\n<p>What makes detection harder is that Solana\u2019s architecture allows program-derived accounts to have their ownership changed if the accounts contain no data.<\/p>\n<p>However, regular user wallets follow different rules. Standard accounts can have their Owner reassigned through program invocations, meaning attackers can abuse this feature if users approve the right signature request.<\/p>\n<p>To protect yourself, always verify the transaction source before clicking links or approving signatures. Never grant permission from unfamiliar <a href=\"https:\/\/cybersecuritynews.com\/5000-fake-online-pharmacies-websites\/\" target=\"_blank\" rel=\"noreferrer noopener\">websites<\/a> or messages claiming to be official announcements.<\/p>\n<p>Consider maintaining separate wallets: one for daily activities with limited funds and another cold storage wallet for valuable assets.<\/p>\n<p>When in doubt about any signature request, reject it immediately. Your caution is your strongest defense against these evolving threats.<\/p>\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 91%,rgb(169,184,195) 100%)\"><strong>Follow us on\u00a0<a href=\"https:\/\/news.google.com\/publications\/CAAqMggKIixDQklTR3dnTWFoY0tGV041WW1WeWMyVmpkWEpwZEhsdVpYZHpMbU52YlNnQVAB?hl=en-IN&amp;gl=IN&amp;ceid=IN:en\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Google News<\/a>,\u00a0<a href=\"https:\/\/www.linkedin.com\/company\/cybersecurity-news\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">LinkedIn<\/a>,\u00a0and\u00a0<a href=\"https:\/\/x.com\/cyber_press_org\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0<strong>Set CSN as a Preferred Source in\u00a0<a href=\"https:\/\/www.google.com\/preferences\/source?q=cybersecuritynews.com\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Google<\/a>.<\/strong><\/p>\n<p>The post <a href=\"https:\/\/cybersecuritynews.com\/beware-of-solana-phishing-attacks\/\">Beware of Solana Phishing Attacks That Let Hackers Initiate Unauthorized Account Transfer<\/a> appeared first on <a href=\"https:\/\/cybersecuritynews.com\/\">Cyber Security News<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Tushar Subhra Dutta<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/cybersecuritynews.com\/beware-of-solana-phishing-attacks\/\">Go to cyber-security-news<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Beware of Solana Phishing Attacks That Let Hackers Initiate Unauthorized Account Transfer A dangerous new wave of phishing attacks is targeting Solana users by changing wallet ownership permissions rather than stealing private keys. A victim lost more than USD 3 million in a single attack, with an additional USD 2 million locked in investment platforms. [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-8954","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8954"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8954"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8954\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}