Attacks that needed a signature

Some of the costliest attacks on Solana did not break a program or steal a key: they got someone to sign. Here are their transactions, as SignLens reads them, and what that does and does not prove.

• The Drift takeover, April 2026

  Two members of a multisig each signed a transaction that never expires; together they handed the protocol to an attacker. Between $270 and $286 million left Drift.

• Owner-change phishing, November 2025

  A preview that "showed no fund changes" hid an unlimited approval on eight token accounts and the wallet itself handed to a drainer. Over $3 million.

• Blind signing: Bybit, Radiant, WazirX

  Three well-known hacks of 2024 and 2025 were signers approving transactions their screens misdescribed. What clear signing changes, and what it cannot.

Try it: install SignLens for Chrome or Firefox.