Phantom Chat Comes Under Scrutiny After $264,000 Theft
The built-in chat feature in the Phantom crypto wallet may be facilitating address poisoning scams
10.02.2026 - 14:30
246
2 min
0
Key points:
- A Phantom user lost approximately $264,000 in Wrapped Bitcoin..
- The attack involved address poisoning, not private key compromise.
- Experts criticize the wallet’s interface for lacking spam filtering.
An investor lost 3.5 Wrapped Bitcoin (wBTC), worth roughly $264,000, in a scam linked to the chat feature of the Phantom crypto wallet. The incident was reported by blockchain investigator ZachXBT, who shared on-chain transaction data related to the theft.
According to blockchain data, the funds were transferred from the victim’s address to a third-party wallet flagged as a high-balance address. The transaction pattern is consistent with an address poisoning attack — a method in which scammers rely on victims copying the wrong address from their transaction history.
How Address Poisoning Works
In this type of attack, scammers first send small transactions to the victim so that the attacker’s address appears in the transaction history. Later, the victim may mistakenly copy that address and send a large amount of funds to it.
ZachXBT urged Phantom to improve its wallet interface, noting that the chat feature could be used as a new vector to draw users into scam schemes. According to him, the application does not adequately filter spam transactions, increasing the likelihood of user error.
Another user also reported falling victim to two similar attacks via Phantom’s chat, losing $136 and $101 in stablecoins.
Phantom has advised users to treat any unexpected tokens or NFTs as potential scams and to avoid clicking links related to token giveaways. The company stated that it has received a request for comment regarding the incident.
Phantom Chat was launched in late December 2025 and is available on pages for tokens, perpetual contracts, and prediction markets.
Useful material?
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Incidents
The user spent weeks unsuccessfully trying to guess the password until Claude helped find an old wallet backup file
May 14, 2026
Crypto regulations
Authorities are introducing mandatory registration for companies handling cross-border crypto transactions
May 8, 2026
Telegram
Twitter