The Mystery Gift
You open your Phantom or Solflare wallet in the morning and notice a new token you never bought. The balance shows 1,000,000 tokens with an estimated value of $5,000, or a colorful NFT displaying a banner that reads: "Claim 50 SOL Voucher at ClaimReward.io".
Before you get excited, understand this reality: nobody is giving away free money to random wallet addresses. You are the target of a wallet poisoning attack.
How Dust and Fake Airdrops Work
Scammers scrape public Solana ledger transactions to find active wallets holding significant SOL balances. Once they have a list of targets, they deploy one of two malicious strategies:
- Phishing Vouchers: Scammers send you an NFT or SPL token whose name is a URL. When you visit the site and click "Claim", the web application requests a transaction approval. Instead of giving you rewards, the transaction grants full token delegation or transfers your existing SOL to the attacker.
- Unsellable Dust Pools: Scammers send you tokens with a high theoretical value. When you try to sell them on Raydium or Jupiter, the transaction fails. You then visit the website linked in the token metadata to investigate, where a malicious decentralized app prompts you to connect and sign your wallet away.
Rules for Handling Unsolicited Tokens
Protecting your assets from wallet poisoning requires strict digital hygiene:
- Never visit URLs in token names: If a token or NFT name includes a web domain, it is guaranteed to be a phishing site.
- Do not interact with the asset: Phantom and Solflare allow you to hide and burn unverified tokens. Use the in-wallet burn feature or simply ignore the asset.
- Never sign blind transactions: If a website prompts for permissions like "SetAuthority" or transfers of native SOL, reject the transaction immediately.
Deep Security with RugPullShield
Contract-level threats and phishing vectors constantly evolve on Solana. RugPullShield monitors threat signatures across the network to identify dangerous contracts before they reach mass circulation. Protect your capital by verifying every contract before interacting, and treat every unsolicited airdrop with extreme caution.