If you see “This account might be malicious. Do not send or deposit funds into it. Please proceed with caution,” Phantom has detected signs that the Solana account may be controlled by a scammer or malicious program.

This warning doesn’t mean Phantom has blocked your account. Your account may have been compromised, which can prevent withdrawals or put new deposits at risk.

Chance of fund recovery #

Recovery may be possible if assets remain in your compromised wallet or connected protocols and you still have the permissions needed to recover them. Eligible assets may include tokens, NFTs, domains, staked assets, and DeFi positions.

SOL held directly in a reassigned account or an attacker-controlled nonce account may be inaccessible. Assets already transferred to an attacker cannot be recovered using this tool.

Step 1: Check whether your account was reassigned or converted to a nonce account #

Every Solana account has an owner program. If you approved a malicious transaction, ownership of your account may have been reassigned to another program or converted to a nonce account controlled by someone else. Either change may prevent you from withdrawing SOL.

1. In Phantom, on the Home tab, select Receive.
2. Copy the Solana address from the account that shows the warning.
3. Go to Solscan and paste your address into the search bar.
4. Locate the Owner and Allocated Data Size fields.

Understand what happened based on these scenarios:

• If Owner is anything other than System Program: In the context of this warning, your wallet address may have been reassigned to a malicious program. Other assets may still be recoverable. Continue to Step 2.
• If Owner is System Program and Allocated Data Size is 80 bytes: Your account may have been converted to a nonce account. If an attacker controls its nonce authority, you cannot withdraw the SOL held directly in it. Other assets may still be recoverable. Continue to Step 2.
• If Owner is System Program and Allocated Data Size is 0 bytes: Your account does not show the reassignment or nonce-account indicators described here. Someone else may still have access through your Secret Recovery Phrase or private key. Continue to Step 3 to secure your wallet. If you can’t move remaining assets normally, review Step 2 for recovery options.

For certain compromised nonce accounts, SOL RECOVERY may offer an option to burn the remaining SOL so an attacker cannot withdraw it. Burning permanently destroys the SOL; it does not recover funds or return them to you.

Step 2: Recover eligible assets #

You may be able to recover held or staked tokens, DeFi positions, NFTs, and domains using SOL RECOVERY, a third-party recovery tool. This tool is not affiliated with Phantom, and recovery is not guaranteed.

1. Go to sol-recovery.io and enter your compromised wallet address.
2. Review the Overview tab to see which assets may still be recoverable and what immediate actions to take.
3. Use the Holdings, Collectibles, Staked, and DeFi tabs to recover specific assets. Each tab guides you through the process, using a separate, secure wallet to cover network fees.

After reviewing your recovery options, continue to Step 3 to secure your wallet.

Step 3: Secure your wallet #

If someone else has your Secret Recovery Phrase or private key, stop using the affected wallet.

1. Create a new Phantom wallet.
2. Move any remaining funds you can access to the new wallet. Don’t deposit SOL into the compromised account to pay fees.

If you imported a Secret Recovery Phrase or private key that someone gave you or that you found online, treat that wallet as compromised. Anyone with the phrase can access all accounts created from it, even if Solscan shows System Program as the owner.

Causes #

You approved a malicious transaction #

A malicious transaction may have reassigned your account to another program or converted it to a nonce account controlled by an attacker. These changes can prevent you from withdrawing SOL. New deposits may also be stolen.

You imported a compromised Secret Recovery Phrase or private key #

Scammers sometimes share recovery phrases or private keys for wallets that appear to contain funds. When you deposit SOL to pay fees or move those funds, the scammer may take your deposit.

This is sometimes called a “rotten seed phrase” scam. The scammer still has access to the wallet, even if Solscan shows System Program as the owner.