A user notices unusual transaction history in their Solflare wallet—transfers they did not authorize, or permissions granted to unfamiliar smart contracts. The wallet exists on a Chrome extension, an Android phone, or both. The immediate instinct is often to change the password, but Solflare uses a non-custodial architecture where the password does not actually protect the private keys in the way a traditional online account does. The real protection is the private key itself, and if a device has been compromised, the password may already be irrelevant. The window for effective action is narrow, measured in minutes rather than hours, and the decisions made in that window determine whether funds can be recovered or are lost entirely.

A compromised Solflare wallet is not a software bug to be patched. It is a cryptographic breach: someone else has either read the private key stored on the device, or obtained the recovery phrase that generates it. The same recovery phrase can restore the wallet on an attacker’s device in seconds. Traditional account recovery—resetting a password, enabling two-factor authentication, contacting support—does not apply because Solflare, like all legitimate non-custodial wallets, has no server that can reverse transactions or revoke access. The only meaningful recovery involves moving funds away from the compromised key before an attacker does. Understanding the sequence, the tools available, and the permanent nature of blockchain transactions is the difference between saving assets and losing them entirely.

Immediate containment: Verifying the compromise and assessing active threats

The first task is to confirm that the wallet is actually compromised rather than mistaking a forgotten transaction or a failed swap attempt for unauthorized activity. Open Solflare on the suspected device and review the transaction history in detail. Look for transfers of SOL or SPL tokens that you did not initiate, approved token authorities or delegations to unfamiliar contract addresses, and changes to staking arrangements. Cross-reference this history against blockchain explorers such as Solscan or Solana Explorer by pasting your wallet address directly into the search box. If the public ledger shows transactions that are not visible in your wallet interface, the device has been compromised. If the history matches, but you are unsure whether you authorized something, check your email for any notifications from the wallet or connected dApps.

Assuming the compromise is confirmed, the next step is isolation, not investigation. Disconnect the compromised device from the internet immediately. If it is a mobile phone, turn off WiFi and disable mobile data. If it is a computer with the Solflare extension, close the browser or disconnect the ethernet cable. This is not a permanent solution—the damage may already be done—but it prevents an attacker who is actively monitoring the wallet from initiating additional transfers while you work. Many compromises are discovered not because a user caught the attack in progress, but because they noticed the aftermath. However, if the compromise is recent and the attacker is still active, disconnecting the device can prevent further losses during the recovery window.

Open a completely different device—a phone, computer, or tablet that has never run Solflare and has not been exposed to the same malware, browser extension, or phishing campaign that compromised the first one. This assumption of complete separation is important. If you suspect that your computer or phone was broadly compromised, the safest assumption is that all devices in the home have been. From the clean device, import the recovery phrase into a fresh Solflare installation to create a temporary viewing wallet. Do not take any action with this wallet yet; the goal at this stage is simply to see the current balance and transaction history from an independent source, confirming the extent of the compromise and the current state of the account.

Pay attention to approved token authorities and contract delegations, which are visible in Solflare’s token management and DeFi sections. These approvals allow external contracts to move tokens on your behalf without requiring further authorization. An attacker with a compromised private key can use existing token approvals to drain funds even after you move the bulk of your balance. The wallet should display these, but a careful review is essential. Take screenshots or notes of any unfamiliar approvals for later reference, as you may need them to understand how the breach occurred.

The clock is running: Emergency fund movement and priority ordering

Once you have a clean device and have confirmed the extent of the compromise, every second matters. The attacker who has your private key can initiate transactions using any clean device they control. Your only structural advantage is that you also have the same private key, and you know the recovery phrase. The attacker does not yet know that you have discovered the breach and are moving the funds. This window might be minutes or hours, depending on how closely they are monitoring the wallet.

Create a new, uncompromised wallet on the clean device. This will have a different recovery phrase and a completely different private key. You can create this directly in Solflare by starting a fresh installation, or you can use a hardware wallet such as a Ledger device if you have one available. The purpose is to generate a destination address that is known only to you and that no attacker can access. Do not use any address that has been associated with the compromised wallet. Do not send funds to an exchange account or a known previous address, as an attacker monitoring the wallet might anticipate that move and set up automated transfers to sweep any incoming funds.

From the clean device, open the imported version of the compromised wallet (the one created from your original recovery phrase) and initiate a transfer of all liquid SOL tokens to the new, uncompromised wallet address. Solflare will calculate the network fee—currently around 0.005 SOL per transaction on the Solana mainnet—and you should approve this cost as a necessary expense of recovery. Do not delay this transfer to save a few cents on fees; an attacker can move your entire balance for less than the cost of one coffee. Approve the transaction and monitor it on the blockchain explorer until it confirms. Solana’s network is fast, and you should see the transaction confirmed within seconds to a minute.

Once the primary SOL balance is secure, move any SPL tokens (including USDC, USDT, or other stablecoin balances) using the same method. If you have a large number of tokens, batch transfers to reduce fees. An attacker is less likely to be actively monitoring for token transfers if they have already extracted the main SOL balance, but speed is still important. For NFTs, the situation is more complex because NFT transfers may require additional approvals or may be locked by contract terms. Collect the NFT addresses and prepare to move them, but prioritize liquid tokens first, as they are more immediately spendable.

Staked SOL (stake accounts) and delegation authorities cannot be transferred directly. If you have staked SOL, you can deactivate the stake account from the compromised wallet, which will begin a warm-up period (typically 1-2 epochs, or roughly 18-36 hours depending on current Solana epoch timing). This prevents further rewards from accruing to the attacker, but it does not immediately make the SOL liquid. Once the warm-up is complete, you can withdraw the unstaked SOL to the new wallet. If you do not have time to wait, accept that the staked portion may be temporarily inaccessible, and prioritize the liquid balance. You can recover staked funds later once the warm-up completes and you have confirmed that the initial emergency is contained.

Token authorities and smart contract approvals: Revoking access before movement

Before moving the recovered funds too far, address any token approvals that an attacker might use. Solflare displays approved token authorities in its token management interface. Each SPL token may have multiple delegates or transfer authorities—the wallet interface should clearly show these. If an attacker has granted themselves authority over your USDC, USDT, or other stablecoin balance, they can drain these tokens even after you move the main SOL balance, or even after you have disabled the private key access itself.

To revoke these approvals, use the wallet’s token management tools to find the “Revoke” option for each unfamiliar approval. This creates a new transaction that removes that authority. Approve and sign these revocation transactions from the clean device using the imported compromised wallet. The network fee for revocation is typically minimal. Perform this revocation step for every unfamiliar approval, even if you do not currently hold large balances of that token. If you approve tokens to a dApp in the future and that approval is granted to an attacker’s address, the same attack vector could be used again.

The common pitfall is assuming that moving funds automatically protects you from existing approvals. It does not. An approval granted to an address is independent of whether you still own the tokens. If an attacker has authority over your USDC, they can follow your USDC to any new address you move it to, and drain it again. Only revoking the approval prevents this. This is why reviewing token authorities is such a critical step in the recovery process, and why it must be done before or immediately after moving funds to safety.

For DeFi protocols and yield platforms, review any active positions. If you have provided liquidity to a Uniswap-style AMM, staked tokens in a yield farm, or provided collateral for a lending position, these may have separate approvals or delegate authorities. Some of these platforms do not allow you to revoke approvals directly through their interface; instead, you may need to close the position (withdraw liquidity, unstake, or repay the loan) to ensure that the funds are no longer under the attacker’s control. This step is more time-consuming but is essential if you have any meaningful DeFi activity. Leaving a position open when your keys are compromised means that an attacker can manipulate the position, capture rewards, or execute liquidations in your name.

Hardware wallet migration: Recovering to an air-gapped device

If you have a Ledger or other hardware wallet available, use it to establish a long-term, secure recovery address. Hardware wallets store private keys in a dedicated chip that never exposes the raw key to the computer or phone that is connected to the internet. Even if your computer is compromised, the hardware wallet cannot be accessed without physical interaction with the device. This is the strongest form of recovery available for long-term holdings.

Connect the hardware wallet to the clean device, open Solflare, and select “Connect Ledger” or the equivalent option for your device. This does not move your keys; it simply allows Solflare to interface with the keys stored on the hardware wallet. Create a derivation path or account within the hardware wallet (Solflare supports multiple accounts, each with a separate address). Note the receiving address associated with this hardware wallet account. This address is now under hardware-level protection, and you should move a portion of your recovered funds here, especially any long-term holdings or large balances.

For users who are using Solflare for the first time after a compromise, the get your wallet extension today process should be followed with hardware wallet connection as the default option if one is available. This design choice significantly reduces the risk of future compromise by ensuring that private keys never exist on an internet-connected device. If you do not currently own a hardware wallet, consider purchasing one after this recovery event, especially if you are managing a meaningful amount of SOL or tokens.

The trade-off is convenience. A hardware wallet is slower to use and requires the physical device to be connected for every transaction. For active trading or frequent transfers, this may be impractical. However, for storing wealth long-term, the security benefit is substantial. A practical approach is to use a hardware wallet for 80–90 percent of your holdings and keep a smaller, more accessible amount in a mobile or extension wallet for daily use. This tiering reduces the impact of a future compromise by limiting the amount that can be lost from a single device breach.

Forensic analysis: Understanding how the compromise occurred

After the immediate crisis is contained and funds are secured, spend time understanding how the breach happened. This step is important not for recovering funds—that is already done—but for preventing a recurrence. The most common sources of compromise are phishing campaigns, malware, browser extensions, and careless recovery phrase handling.

Review your browser extension history and installed extensions. If you have any extension that you do not recognize or do not regularly use, remove it. Check whether you have visited any websites that ask for your recovery phrase or private key. Legitimate Solflare wallets never ask for this information; if you have ever entered a recovery phrase on a website, that website is almost certainly a phishing site, and your wallet keys have been compromised through that vector. Search your email for any suspicious messages claiming to be from Solflare support, fake login attempts, or warnings about your account. These are often the vectors through which phishing links are delivered.

Check your browser history and your phone’s app installation history for any unfamiliar applications or sites. Many malware campaigns disguise themselves as legitimate wallet apps or security tools. The Google Play Store and Apple App Store have some protections, but fake apps do occasionally appear. Verify that you are using the official Solflare application from Anza—the organization that develops and maintains the wallet—not an imposter.

If the compromise occurred on a desktop computer, consider running a full antivirus or malware scan using a reputable tool such as Malwarebytes. Be aware that malware can survive typical antivirus scans, and if you believe the computer was compromised, the safest course is to assume that all accounts accessed from that device have been exposed. Change passwords for email accounts, exchanges, and other critical services from a different device. If you use a password manager, check whether it was accessible from the compromised device, and update all passwords stored in it from a clean device afterward.

For mobile compromises, determine whether you installed an app from outside the official app store, granted unusual permissions to an app, or if your phone has been physically accessed by someone else. Many phone-based compromises occur through spyware apps installed by someone with physical access, or through social engineering that convinces you to grant excessive permissions to a malicious app. If the phone was accessed by an untrusted person, the safest approach is to reset the phone to factory settings before using it to store wallet data again. Do not assume that simply removing one app has fixed the problem if malware was present.

Permanent recovery: Creating a sustainable security posture

The measures taken during the emergency—moving funds to a new wallet, revoking approvals, connecting a hardware wallet—are appropriate for crisis management. But the goal is to ensure that this does not happen again. That requires a security posture that is sustainable and realistic for your level of usage.

The foundational step is recovery phrase storage. Your recovery phrase is a cryptographic master key that generates all private keys for your wallet. Anyone who obtains this phrase can access all your funds across any device. Never store it in cloud services, email, or password managers. Never photograph it or send it as a message. The secure standard is to write it on paper or engrave it on steel, store this physical backup in a location that is physically secure (a safe, a safety deposit box, a hidden location), and ensure that no one else has access to it. If you are concerned about total loss (fire, theft of the safe), you can split the phrase using Shamir’s Secret Sharing or store copies in multiple secure locations, but ordinary users should default to one physical backup in a secure location.

The second pillar is device security. Use strong, unique passwords for every online account. Enable two-factor authentication wherever it is offered, using an authenticator app rather than SMS if possible. Keep your operating system, browser, and applications updated with the latest security patches. Disable browser extensions that you do not actively use. Consider using a separate browser or user account on your computer for crypto transactions, isolating them from your everyday browsing. These measures do not guarantee that a device will never be compromised, but they significantly raise the cost and complexity of doing so.

The third element is compartmentalization. If you are managing a large amount of cryptocurrency, avoid storing everything in one wallet or on one device. The tiered approach mentioned earlier—hardware wallet for long-term holdings, mobile wallet for active transactions, exchange accounts for trading—ensures that a compromise of any one component does not result in total loss. Update your security approach as your holdings grow. What is acceptable security for a $500 cryptocurrency position may not be acceptable for $50,000.

Finally, stay informed about security developments and phishing campaigns. Solana and Solflare communities often discuss recent exploits and scams through official Discord servers, Twitter accounts, and subreddits. Following these channels helps you recognize new attack vectors before they affect you. Legitimate wallet developers and ecosystem projects never pressure you to act quickly, never ask for your recovery phrase, and never conduct support through unofficial channels. If you are ever uncertain about a security decision, consulting the official Solflare documentation or verified community channels is more reliable than trusting your intuition.

What to accept about permanent loss and when to consider it final

Despite all efforts, some compromises result in total loss. If funds were moved before you discovered the compromise, and the attacker has already converted them or moved them to an address that is not trackable, recovery is not possible. Blockchain transactions are permanent and irreversible. Law enforcement and blockchain analysis firms can sometimes track stolen funds, but this is a specialized process with uncertain outcomes and is more relevant to large-scale theft than to individual account compromises.

The emotional urge to recover lost funds should not lead you to pursue recovery options that are likely scams. Recovery services that claim to restore lost cryptocurrency by contacting “blockchain authorities” or paying fees to unlock stolen funds are themselves scams. There is no process of this kind. If your funds were stolen, the only legitimate recovery path is the one described in this article: moving remaining uncompromised assets to a new wallet and improving security going forward.

Accept that a security incident is often a signal to reassess your overall risk tolerance and holdings size. If losing a particular amount would cause financial hardship, you are holding too much on an internet-connected device. If the recovery process reveals that you do not understand how the wallet or blockchain works, that is information that should inform your next steps: either deepen your knowledge before holding larger amounts, or reduce holdings to a size you feel confident managing. The goal of security is not to eliminate all risk—that is impossible—but to match the security measures you take to the amount at stake and your realistic ability to maintain those measures.