My Solana wallet was drained — what do I do first?

Assume your key is compromised. From a clean device, immediately move any remaining assets into a brand-new wallet with a new seed phrase. Only after that do you analyze what happened. Never enter your old seed phrase anywhere again.

Can I get my drained tokens or SOL back?

As a rule, no. On-chain transfers are final and irreversible. No one — not even support — can undo a confirmed transaction. Be especially suspicious of services that promise 'recovery' for an upfront fee; that is almost always a second scam.

What is a wallet drainer?

A drainer is malicious code that gains access to your tokens through a fraudulent 'approve' or signature request and pulls them out automatically. It often runs through a fake airdrop or mint site. Active approvals (delegations) let the attacker keep pulling until you revoke them.

How do I find out where my funds went?

In a block explorer, open the draining transaction, read the timestamp and destination address, and follow the flow onward. This does not prove who is behind it, but it documents the incident. This article is education, not investment advice.

Solana Wallet Hacked or Drained: What to Do Now

A drained wallet is a shock — but the next few minutes matter. On Solana every step is publicly traceable, and that is exactly what helps you now to limit the damage and reconstruct the incident cleanly.

Short answer: Assume your key is compromised. From a clean device, move any remaining assets into a new wallet, revoke open token approvals, identify the attack vector, reconstruct the draining transaction in a block explorer — and know this: on-chain transfers are final, recovery is rarely possible.

In plain terms: You usually cannot get the stolen funds back. But you can stop further damage, understand how it happened, and document it cleanly — without falling for “recovery” scammers.

1. Immediately: Secure Remaining Assets to a New Wallet

Treat the affected wallet as irreversibly compromised from now on — whether the attacker has your seed phrase or your private key. From a clean device, set up a brand-new wallet with a new seed phrase and move any remaining assets there. Never enter the old seed phrase anywhere again. How to set up a wallet cleanly: Solana wallet setup.

2. Revoke Open Token Approvals and Delegations

Many drainers don’t empty a wallet in one go — they work through a granted approval (delegation) and keep pulling whenever new funds arrive. A revoke tool in the explorer or in your wallet shows granted token delegations so you can withdraw them. As long as you’re still using a wallet (for example to rescue leftovers), cut these open permissions so no automatic top-up drain is possible.

3. Identify the Attack Vector

Understand how the access happened — otherwise it repeats. Typical vectors:

Leaked seed phrase or private key — entered somewhere, photographed, stored in the cloud or in plain text.
Malicious “approve” signature on a phishing or drainer site, often disguised as a fake airdrop or mint.
Fake airdrop token that lures you to a fraudulent site to “claim” it.
Malware on the device reading the clipboard or keys.

Depending on which path it was, your follow-up differs — new device, new keys, different habits.

4. Reconstruct the Drain in a Block Explorer

Now you work like an investigator. Open the affected wallet in a block explorer and find the draining transaction(s): the timestamp, which tokens/amounts moved, and the destination address. From there you follow the flow onward — often through intermediate wallets. Step-by-step reading of a transaction: using Solscan. How to trace funds across multiple hops: trace fund flow.

5. The Honest Truth: On-Chain Is Final

The most important point, said plainly: a confirmed Solana transaction cannot be reversed. There is no central party that books the funds back to you — recovery is conceivable only in rare exceptions (for example when a cooperating centralized exchange is the end destination). It is exactly this distress that “recovery” scammers exploit: they message victims, promise recovery for an upfront fee, and drain them a second time. Assume that any unsolicited “we’ll get your money back” is a scam.

6. Harden for the Future

Learning from the incident means shrinking your attack surface. A hardware wallet keeps the key offline. Separate a small hot wallet for interacting from your storage wallet. Inspect every signature request before you confirm, and avoid unsolicited airdrops and mint links. The full hygiene: Solana wallet security. Vetting wallets and tokens beforehand: check for scams.

Important Context

This article explains the method on general patterns — how a drain typically unfolds and how you read it on-chain. It does not label any specific, real wallet as the culprit; a destination address in a transaction does not prove who is behind it. This is reporting, security hygiene, and reconstruction — not a recovery service. Verify for yourself, judge for yourself.

Not financial or investment advice. This article is for education and self-defense.

If You Want to Dig Deeper

Following the flow of stolen funds across many hops and intermediate wallets by hand is tedious and quickly gets confusing. For automated, deeper forensics (fund flow, clusters, destination endpoints) there is Scry, our affordable wallet-intelligence interface. This changes nothing about on-chain finality — but it helps document the incident cleanly.

Sources and Further Reading

SOLANA·HUB knowledge: Solana wallet security · Using Solscan · Trace fund flow · Check for scams · Wallet setup
SOLANA·HUB glossary: Seed phrase · Private key · Rugpull · Airdrop