Connected Phantom to a Scam Site? What to Do Now

Connecting Phantom to the wrong website is serious, but it does not always mean the site can immediately empty your wallet. The right response depends on what you approved: a connection, a signed message, a transaction, or disclosure of your Secret Recovery Phrase or private key.

Do the containment steps first. You can investigate the site after the wallet is no longer exposed.

What should you do after connecting Phantom to a scam site?

Follow this order:

1. Close the scam page and reject open prompts. Do not sign a second request that claims to cancel, verify, refund, or secure the first one.
2. Disconnect the app in Phantom. Open your profile, go to Settings → Connected Apps, and disconnect the suspicious entry. If you are unsure which entry it used, Phantom's current scam-response guide recommends disconnecting all apps.
3. Scan for token approvals with Sol Incinerator's Revoke tool. Disconnecting and revoking are separate actions. The tool scans for revocable account-level delegates across SPL Token and Token-2022 accounts, lets you review the token, approved address, and allowance, and removes only the approvals you select. The scan is read-only, and Sol Incinerator charges no platform fee for revoking.
4. Move trusted assets if you signed something suspicious. If you cannot confidently explain what the transaction changed, create a fresh wallet and move the assets you trust. Do not interact with unexpected tokens or links while doing this.
5. Review and record recent activity. Look for transactions at the time you visited the site. Open unfamiliar signatures in a Solana explorer and preserve them for investigation and reporting.

Is Phantom compromised if you only connected?

Phantom's developer documentation describes a connection as permission to share your public key. Once connected, the site can see the connected address and send additional requests to Phantom, but those requests still appear for your approval.

That creates four different risk levels:

According to Phantom's connection documentation, a connected app receives the public key and can prompt for transactions. It does not receive the private key. This is why someone who only connected and rejected every later prompt is in a different position from someone who signed an unknown transaction.

What if you signed a suspicious Solana transaction?

A signed transaction is the point where you should assume an on-chain action may have happened. Solana transactions can combine several instructions, and those instructions execute together if the transaction succeeds. A request presented as a claim could transfer assets, approve a token delegate, or change an authority.

After the immediate disconnect, revoke, and migration steps, open the transaction signature from Phantom's Activity tab. Check whether it confirmed, then inspect the accounts, token balance changes, and instructions in the official Solana Explorer. Do not delay moving remaining trusted assets solely to decode every instruction, and do not conclude that the absence of an obvious SOL transfer means nothing changed.

Confirmed transfers cannot be canceled. Phantom is self-custodial and states that it cannot reverse blockchain transactions, freeze the recipient, or recover stolen assets. Disconnecting the site only stops the connection; revoking a delegate only removes that remaining permission. Neither action rewinds a transaction that already executed.

If anything remains unexplained, follow Phantom's conservative response: create a new wallet and move trusted assets. Its wallet migration guide also says to check collectibles, staked tokens, DeFi positions, and other open positions before retiring the old wallet. Some positions need to be withdrawn, unstaked, or closed before they can move.

How do you revoke scam dApp permissions on Solana?

Solana token approvals are account-level delegates. A delegate can transfer or burn up to an approved amount from one specific token account without asking you to sign again. The Solana Token Programs allow one current delegate per token account, and a Revoke instruction clears its remaining allowance.

Open the Sol Incinerator Revoke tool, connect the wallet you want to check, and review the approvals it finds. The tool scans SPL Token and Token-2022 accounts for revocable account-level delegates, shows the token mint, approved address, and allowance, and lets you remove several selected approvals through a batched transaction flow. The initial scan is read-only. Revoking is non-destructive: it does not burn tokens, transfer assets, or close token accounts. Sol Incinerator charges no platform fee, so you pay only the Solana network fee when you sign a revoke transaction.

Not every delegate is malicious. NFT marketplaces, staking services, and vaults can use delegates as part of normal operation. Verify each entry before revoking it, because removing a legitimate delegate may cancel a listing or interrupt an active position.

Do you need to restore the correct authority after revoking?

Do not copy an authority address from a support message or sign a transaction that claims it must "restore," "validate," or "synchronize" your authority. For an ordinary malicious approval, the safe state is no delegate. A trusted app can request a new, limited approval when you intentionally use it again.

The owner, delegate, close authority, mint authority, and freeze authority are different roles. Sol Incinerator's Revoke tool handles only the revocable delegate recorded on a token account. It does not change token-account ownership, close authority, or authorities controlled by the token's issuer.

If a Solana explorer shows that your wallet is no longer the token account owner, the situation cannot be repaired with a revoke. Only the current owner can authorize another ownership change, so treat that token account as outside your control and move other assets you still control to a fresh wallet. If you find an unfamiliar close authority, prioritize moving the token balance you still control into a new token account or fresh wallet; a close authority cannot transfer that balance, but it may be able to close the old account after the balance reaches zero and receive its rent.

This is intentionally narrower than a claim that the wallet is now completely safe. Revoking account-level delegates does not:

• reverse a completed transfer;
• rotate an exposed recovery phrase or private key;
• inspect every protocol-specific position or authority;
• clear a Token-2022 permanent delegate stored on the mint; or
• revoke a frozen token account until the authority responsible for the freeze thaws it.

If you want the technical detail, read How to Revoke Token Permissions on Solana. For incident response, the important rule is simpler: revoke suspicious delegates, but migrate if you cannot rule out wider compromise.

What if you signed a message instead of a transaction?

Phantom's signMessage documentation describes message signing as a way to prove ownership of an address without paying an on-chain network fee. It is commonly used to log in, so a message signature is not the same thing as a confirmed token transfer.

It is not automatically harmless. Phantom has documented how generic login signatures can be replayed to impersonate a user when the message lacks protections such as the requesting domain, a one-time nonce, and an issuance time. If you signed an unreadable or unexpected message, disconnect the site, preserve the message if possible, and monitor activity. An on-chain token revoke does not cancel an off-chain signature. If another suspicious action occurred or you are unsure what you approved, use the stronger new-wallet response.

When should you replace the Phantom wallet completely?

Replace the wallet when any of these is true:

• you entered or shared the Secret Recovery Phrase or private key;
• the device or browser may contain malware or an untrusted extension;
• you signed a suspicious transaction whose effects you cannot confidently bound; or
• unexplained transactions continue after disconnecting and revoking.

Create a new wallet with a fresh recovery phrase. Adding another account under the exposed phrase does not remove the attacker's access to that phrase. Store the new phrase offline, transfer trusted assets, confirm they arrived, and then stop using the old wallet.

Keep enough SOL in the old wallet to pay for the transfers you still need. Check staked assets and protocol positions separately rather than assuming everything appears in the main token list.

What evidence should you save and where should you report it?

Save the transaction signatures, suspected scammer addresses, exact website URL, screenshots, dates, messages, and the assets or amounts involved. Do this before browser history, posts, or scam pages disappear.

Phantom's incident guide points users to Chainabuse for a public blockchain abuse report. You can also report significant losses to local law enforcement; US users can file with the FBI Internet Crime Complaint Center. Reporting cannot guarantee recovery, but it creates a record that investigators, exchanges, and other users can reference.

How can you reduce the risk next time?

• Open dApps from a project's verified website or Phantom's Explore directory, not ads, DMs, token metadata, or unsolicited comments.
• Read Phantom's simulated balance changes and warnings before signing. Reject the request if the destination, authority change, or outcome is unclear.
• Use a separate wallet with limited funds for unfamiliar sites, mints, and claims.
• Keep valuable assets behind a hardware wallet, while remembering that hardware protects the key—not against approving a malicious transaction on the device.
• Periodically disconnect apps you no longer use and scan for old token delegates.

Related Reading

• How to Revoke Token Permissions on Solana
• Is Sol Incinerator Safe?
• How to Burn Scam and Spam Tokens on Solana