Keeping your Solana wallet safe

Keeping a Solana wallet safe comes down to three habits: never share your recovery phrase with anyone or type it into any website, keep your savings in a separate wallet from the one you trade with, and read what you are signing before you approve it. Crypto transactions cannot be reversed. If someone tricks you into handing over access, the money is almost always gone for good.

The words you need first

Wallet: an app (like a browser extension or phone app) that holds the keys to your crypto. Your tokens live on the blockchain. The wallet proves they are yours.
Recovery phrase (seed phrase): usually 12 or 24 words that can rebuild your wallet on any device. Whoever has these words has your money.
Private key: the secret that controls a single wallet address. Same rule: whoever has it has your money.
Signing: approving a transaction or message in your wallet. Signing is how you say yes to anything on-chain.
Drainer: a malicious website or transaction designed to empty your wallet once you sign.

Rule one: your recovery phrase is never needed online

No genuine website, exchange, support agent, airdrop or "wallet validation" ever needs your recovery phrase. The only time you should type it is when restoring your own wallet inside the official wallet app.

Write it on paper (or stamp it in metal) and store it somewhere safe and offline.
Do not keep it in photos, cloud notes, email drafts, password managers you share or chat messages.
Never read it out on a call or screen share.

Warning: Anyone who asks for your recovery phrase is trying to steal from you. There are no exceptions.

Rule two: separate your wallets

Memecoin trading means connecting to new sites and signing a lot of transactions. That is exactly where wallets get drained. Limit the damage by splitting your funds:

Wallet	What it is for	What goes in it
Vault	Long-term holdings	Most of your crypto. Never connected to trading sites. A hardware wallet (a small physical device that keeps keys offline) is a good option
Trading	Day-to-day swaps	Only what you are prepared to lose
Burner	Trying unfamiliar sites or claims	Almost nothing

If your trading wallet is compromised, your vault is untouched. Moving profits out of your trading wallet regularly also helps. See taking profits.

Be careful with trading bots that ask you to import a private key or create a wallet they control. When a service holds your key, your funds are only as safe as that service.

Rule three: read what you sign

Most Solana wallets show a preview of what a transaction will do before you approve it, and many warn you about known malicious sites. Use that preview:

Check what leaves your wallet. If you expected to receive something and the preview shows tokens or SOL going out, reject it.
Be suspicious of anything you did not start. A pop-up asking you to sign when you only loaded a page is a red flag.
Read warnings, do not click past them. Wallet warnings are not perfect, but ignoring one is a common way people get drained.
When in doubt, reject. You can always come back later. A signed transaction cannot be undone.

The common scams

Fake sites. Drainer sites copy the look of real wallets and exchanges exactly. The only differences are the web address and what happens when you sign. Bookmark the sites you use and open them from your bookmarks. Do not trust links in search adverts, replies or messages.

Fake support. Scammers watch public channels for people asking for help, then message them pretending to be support staff. Jupiter's own guidance says its team will never message you first. Treat any unsolicited direct message offering help, a giveaway or a link as a scam, and turn off direct messages from strangers on Discord and Telegram.

Fake airdrops and "send to receive". Tokens and NFTs often appear in wallets uninvited, with a link to "claim" something. Do not visit the link. Real airdrops do not ask you to send funds first or sign unexpected transactions.

Lookalike addresses. Some scammers send tiny transfers from addresses that start and end with the same characters as one you use, hoping you copy the wrong one from your history later. Always copy addresses from a trusted source and check the whole thing, not just the first and last few characters.

Copycat tokens. Not a wallet hack, but a common way to lose money: buying a token with the right name and the wrong address. See copycat tokens.

Selling your old wallet. People buy aged wallets to make fake activity look real, for example to make a coin look popular before a rug pull. Do not sell yours.

Keep your device clean

Use a separate browser profile for crypto with as few extensions as possible. Jupiter's documentation warns that some extensions can inject extra fees into swaps.
Keep your operating system, browser and wallet app updated.
Do not install software or browser extensions sent to you by strangers, including "trading tools" and "airdrop checkers".
Use a strong, unique password and two-factor authentication on any exchange account.

If you think you have been drained

Stop signing anything from the site involved.
Create a brand new wallet with a new recovery phrase, on a device you trust.
Move anything left in the affected wallet to the new one. Do not reuse the old recovery phrase.
Report the site to your wallet provider. In England, Wales and Northern Ireland, report the fraud to Report Fraud (the police service that replaced Action Fraud). In Scotland, contact Police Scotland on 101.
Be very wary of "recovery services" that contact you afterwards. Many are a second scam aimed at victims.

Wallet safety protects your keys. It does not protect you from buying a bad coin. Check a coin's warning signs on our live board before you trade.

Not financial advice. This guide explains how things work. It is not a recommendation to buy, sell or hold anything. Memecoins are extremely high risk and most go to zero.