Solana Phishing Attack Replaces Owner Permission, Over $3M Stolen and $2M Recovered – SlowMist Security Advisory

SlowMist Security Team issued a security advisory after a targeted phishing incident that replaced the victim’s Owner permission, effectively freezing transfers and revocation. The attacker drained assets valued at more than $3 million, while roughly $2 million held within a DeFi protocol position was later recovered with protocol assistance.

Two counterintuitive ploys enabled the breach: the wallet’s signature prompt appeared to show no fund changes, masking the theft, while cross‑chain nuances suggested ownership could be altered—an aspect many users overlook. The advisory warns vigilance when authorizing signatures.

Readers should scrutinize for hidden operations that modify high‑risk permissions, such as Owner access, and confirm the scope of approvals before signing. Consider enabling hardware wallets, multi-signature setups, and continuous security monitoring to mitigate phishing and unauthorized access.

Stay vigilant and follow SlowMist’s ongoing crypto security alerts to strengthen defenses against credential theft and permission abuse.