Phantom Faces $3.1M Lawsuit After $500K Hack

Phantom Technologies, a prominent Solana-based wallet provider, is facing a significant legal challenge following a security breach that resulted in the theft of over $500,000 worth of digital assets. The incident has sparked a lawsuit demanding $3.1 million in damages and has raised serious concerns about the security practices of crypto wallets.

A group of investors, led by attorney Thomas Liam Murphy, filed the lawsuit in the Southern District of New York on April 14. The core of the complaint centers around the allegation that Phantom's wallet stored users' private keys in unencrypted browser memory, making them highly susceptible to exploitation by malware and rogue browser extensions. According to the lawsuit, a hacker exploited this vulnerability to gain access to Murphy's Phantom wallet, extracting his private key from active memory without needing to bypass multi-factor authentication. The cybercriminal then drained over $500,000 in Wiener Doge tokens, a Solana-based meme coin created by Murphy.

The stolen assets were converted into Solana (SOL) and sold off using Phantom’s built-in “Swapper” tool. This sudden liquidation caused a 99% drop in Wiener Doge’s value, with the price crashing from $3.10 to under $0.01 per token. The lawsuit claims that Phantom not only failed to secure user assets but also knowingly ignored known vulnerabilities. According to court documents, Phantom executives were fully aware that private keys were stored in memory accessible to browser processes. The plaintiffs argue that Phantom lacked basic safeguards typically found in custodial platforms, such as velocity checks, withdrawal limits, or geolocation anomaly detection. Despite Murphy reporting the hack immediately, Phantom allegedly responded that it was a noncustodial wallet, placing full responsibility on the user. The company reportedly denied liability, even though it had facilitated the transaction through its own interface.

The lawsuit also targets OKX, alleging that the exchange should have known that Phantom’s built-in Swapper function was not registered as a Swap Execution Facility (SEF) with the U.S. Commodity Futures Trading Commission (CFTC). OKX has previously pleaded guilty to money laundering-related charges, further intensifying scrutiny. The plaintiffs assert that both Phantom and OKX functioned as unregistered trading platforms, despite advertising their tools as safe and user-controlled. The group of 14 plaintiffs, including Murphy and his friends and family, is now seeking $3.1 million in damages—equivalent to $3.10 per lost Wiener Doge token. This figure reflects the token’s peak market price before the incident.

Phantom, which is used by over 10 million users and hosts $25 billion in digital assets, is accused of operating more like an exchange than a traditional crypto wallet. The legal filing lists seven major claims against Phantom, including operating as an unregistered trading platform, negligence in security practices, fraudulent marketing of security features, and aiding and abetting money laundering through OKX. Phantom has not yet published a thorough public reaction but has said it “strongly denies any allegations of wrongdoing” and hopes to show the assertions “entirely without merit.”

This case highlights the increasing consumer and regulatory scrutiny of wallets with integrated swap capabilities. Critics say these qualities raise retail investor risks by blurring the distinction between wallet and exchange. Phantom's rapid rise, with a $3 billion valuation and support for multiple blockchain networks, has drawn attention to the need for enhanced security measures in the crypto wallet space. The outcome of this lawsuit could set a precedent for how crypto wallets are regulated and held accountable for security breaches in the future.