My Phantom wallet was drained on Solana. What information should I collect first?

Start with the on-chain trail

• Save the wallet address, drain transaction signatures, token account activity, and destination wallets from Solana explorers.
• Capture screenshots of the wallet activity page before the interface changes.
• Record which site or dapp you used just before the drain.

What matters most

• The exact signature that granted permission or initiated the drain.
• The token list and balances before and after the incident.
• Any NFT approvals or suspicious swaps that happened right before the loss.

How to secure the situation

• Stop using the affected wallet and create a new one from a clean device.
• Disconnect from dapps where possible, but assume the old wallet is no longer safe for storage.
• Warn any communities or contacts if a fake mint, airdrop, or support request led to the compromise.

Where recovery efforts focus

• Solana drains move fast, so timing matters.
• The useful path is tracing where the assets were bridged, swapped, or cashed out.