Is Phantom safe to connect?
Self-custody wallet ยท Solana, Ethereum, others. Checked 2026-10-25; every line links its source.
Worst case: Phantom is self-custody: anyone who gets your recovery phrase (for example through a fake Phantom extension or a 'support' DM), or who gets you to sign a malicious approval, can empty the wallet, and Phantom can't reverse or freeze anything.
Safe setup in 3 steps
- Install only from phantom.com/download: Chrome Web Store ID bfnaelmomeimhlpmgjnjophhpkkoljpa, App Store id1598432977, Google Play app.phantom. Phantom has no Firefox add-on.
- Phantom Support never messages you first. Only use the in-app chat, and never type your recovery phrase anywhere. After using a new dapp, revoke its spending permissions (Revoke.cash for EVM, Famous Fox's Revoker for Solana), because disconnecting doesn't revoke them.
- Give bots and new dapps a separate Phantom account holding only what you can lose. Copy addresses from your own address book, not from transaction history or chat, to avoid address poisoning.
What it can do with your money
| Who holds the keys | You hold the keys 'Phantom is a self-custodial wallet: you control your private keys.' Some extras run through third parties: Phantom Cash's card and virtual accounts need KYC done by Stripe, with the card issued by Lead Bank and run by Bridge (https://phantom.com/learn/blog/introducing-phantom-cash). Kalshi prediction markets (US) need identity verification. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every send yourself, to any address. Phantom 'cannot reverse transactions, freeze assets, or recover stolen funds.' source |
| Swaps and third parties | In-app swaps are routed by third-party providers, including bridge providers for cross-chain swaps, and you can choose the provider for each swap. The confirmation screen shows a Phantom fee plus the network fee. Phantom can't reverse a swap or a send. Disconnecting a dapp does NOT revoke spending permissions: revoke them with Revoke.cash (EVM) or Famous Fox's Revoker (Solana). source |
Official links
- Website:
phantom.com - Website:
phantom.app - X:
@phantom - GitHub:
github.com/phantom - App:
https://chromewebstore.google.com/detail/phantom/bfnaelmomeimhlpmgjnjophhpkkoljpa - App:
https://apps.apple.com/us/app/phantom-trading-wallet/id1598432977 - App:
https://play.google.com/store/apps/details?id=app.phantom
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-04-06 | Service outage: token prices and balances shown wrongly in the app. Phantom said 'Your funds are safe' and reported it resolved the same night. Users on X reported they couldn't sell (user reports, not verified). | resolved same day; Phantom said funds not affected | source | |
| 2026-02-10 | Address poisoning linked to Phantom's built-in chat (Phantom Chat, launched 2025-12-23): one user sent 3.5 WBTC (~$264,000) to a look-alike address. ZachXBT said the chat did not filter spam transactions (Cointelegraph, third-party report). | 3.5 WBTC (~$264,000) | not recovered (no Phantom comment in the report) | source |
| 2025-07-03 | Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Phantom, MetaMask, Coinbase, Trust Wallet, Exodus, OKX and others to steal seed phrases (third-party report; extension IDs not given in the coverage). | reported to Mozilla | source | |
| 2024-10-28 | Outage during the GRASS airdrop: wrong balances shown for about 3.5 hours. Phantom told users 'Your funds are safe.' | resolved same day | source |