SignLens

Incidents › Owner-change phishing, November 2025

An owner-change phish: no balance change, the whole wallet

Published

On 26 November 2025 a Solana user signed transactions that a balance preview showed as changing nothing. Eighteen seconds later their wallet was empty. SlowMist, which investigated, put the loss above $3 million, of which about $2 million sitting in DeFi positions was later recovered.

What the transactions did

The attacker paid the fees. At the top level the transactions held only compute-budget settings and calls to a program of the attacker's own. Inside it, that program approved the attacker to spend an unlimited amount from eight of the victim's token accounts, then used the system program's Assign to hand the victim's wallet account itself to a drainer program: an owner change. Nothing left the wallet at signing, so the preview showed nothing.

As SignLens reads it

Blocked

3 actions

  1. Call unknown program 3W2y…W3rs
  2. Call unknown program 3W2y…W3rs
  3. Call unknown program 3W2y…W3rs

What SignLens found

What this does

Full text, as the engine prints it
3 actions: Call unknown program 3W2y…W3rs; Call unknown program 3W2y…W3rs; Call unknown program 3W2y…W3rs
BLOCKED BY DEFAULT (3 critical findings)

Findings:
  [CRITICAL] No reviewed descriptor exists for this program; what it does cannot be shown (instruction 3)
  [CRITICAL] No reviewed descriptor exists for this program; what it does cannot be shown (instruction 4)
  [CRITICAL] No reviewed descriptor exists for this program; what it does cannot be shown (instruction 5)
  [INFO] The fee is paid by ATNm…2FjE, not by you

== Unknown instruction
  Program: 3W2y8TuU2rKf4qvrKZAbu8Tu9najg9Bvcwfsf28aW3rs
  Accounts: 7
  Data: 0x0900000000000000

== Unknown instruction
  Program: 3W2y8TuU2rKf4qvrKZAbu8Tu9najg9Bvcwfsf28aW3rs
  Accounts: 7
  Data: 0x0900000000000000

== Unknown instruction
  Program: 3W2y8TuU2rKf4qvrKZAbu8Tu9najg9Bvcwfsf28aW3rs
  Accounts: 4
  Data: 0x0a00000000000000

== Also [collapsed]
  Compute unit limit: 1000000
  Compute unit price: 200,000 micro-lamports per compute unit

== Signers
  Fee payer: ATNmwM5NAKAJ7pftDA2oQteHD9hvHDAn1XDQt7Rp2FjE
  Signer: Your wallet (9w2e…q6Wb)

== Fee
  Total: 0.00021 SOL
  Base: 0.00001 SOL
  Priority: 0.0002 SOL
  Priority basis: 200,000 micro-lamports per compute unit × 1,000,000 compute units requested

== Validity
  Expires: in about a minute (recent blockhash)

Effects:
  - ATNmwM5NAKAJ7pftDA2oQteHD9hvHDAn1XDQt7Rp2FjE pays a fee of 0.00021 SOL
  - Valid for about a minute (recent blockhash)

Raw: solana v0 (462 bytes)
  digest: dcec187cb5d09bf98859f0651be67acb089c3272d46e8d1d7dff14f9e94969fd
Mainnet transaction 524t…tMVJ, slot 382,532,590. Explained for 9w2e…q6Wb as the signer, by the SignLens engine 0.3.0, on 2026-11-01. How to read this.

SignLens does not name the approvals and the Assign: they run inside the attacker's program, which it has no description of. It blocks the transaction for that reason, with three critical findings, and notes that the fee is paid by someone else, an unusual thing for a transaction you start yourself.

Try it: install SignLens for Chrome or Firefox.

Sources