A lawsuit filed Monday against Phantom Technologies alleges that security vulnerabilities in its crypto wallet, Phantom, led to the theft of over $500,000 worth of Wiener Doge (WIENER) tokens from a developer's account.
A cybercriminal "hacked into Liam's personal computer and exported Liam's private key to his Phantom wallets from his web browser's working memory," a copy of the court document obtained by Decrypt reads.
The attacker gained "unrestricted access to all of the funds in Liam's three co-linked Phantom wallets" without needing to bypass multi-factor authentication, the complaint claimed.
A complaint filed April 14 in the Southern District of New York by crypto law firm Murphy's Law founding partner Thomas Liam Murphy and 13 other plaintiffs alleges that Phantom exposed users to malware and crypto theft due to fundamental design flaws, despite marketing its security as “best-in-class.”
Phantom, valued at over $3 billion and widely regarded as the go-to wallet for Solana blockchain users, allegedly stored users' private keys in "unencrypted browser memory," making them vulnerable to extraction by malware.
"We are aware of the lawsuit that has been filed against Phantom, strongly deny any allegations of wrongdoing, and look forward to demonstrating why this lawsuit should be dismissed," a Phantom spokesperson told Decrypt. "The claims in this lawsuit are entirely without merit."
Phantom said it gives users full control of their funds and can’t prevent scams from malicious links, but works with law enforcement when criminal activity is reported. It also said it offers in-app security education and safety resources.
Dave Portnoy Is Trading Solana Meme Coins and Just Doxxed His Wallet: 'I’m Not Trying to Be Shady'
He pumped and dumped Solana meme coins today for $68K in profit. Welcome to the trenches, Mr. Dave Portnoy. The Barstool Sports founder today took to X (formerly Twitter) to reveal to the world that he’s learned how to trade shitcoins, and doxxed his Solana wallet to the public in the process. “Uh oh. Davey learned how to trade shitcoin and is already up a billion percent on my 1st one!!!!!!,” he posted alongside a screenshot of a Phantom wallet with 2.68 million MONTOYA tokens—a meme coin base...
Checks and limits
Murphy claims he reported the theft to Phantom immediately, but the company allegedly responded that it operated "a noncustodial wallet," which meant that Murphy bore "sole responsibility” for any loss of his crypto.
As a major crypto wallet, Phantom hosts assets worth approximately $25 billion across 10 million active users, the lawsuit claims.
It further alleges a cybercriminal used Phantom's built-in "Swapper" feature to liquidate Wiener Doge tokens worth approximately $500,000 for only $37,537 in Solana (SOL).
That mass liquidation allegedly destroyed the value of the entire Wiener Doge project, which had reached a market capitalization of $3.1 million at peak, according to data from GeckoTerminal.
Phantom "lacked any system for transaction velocity checks, geolocation anomalies, or withdrawal limits," comparing the Solana wallet to how Coinbase wallets operate, the complaint reads.
The suit also names OKX, a crypto exchange that partnered with Phantom in November 2024. The complaint cites OKX’s guilty plea to federal money laundering charges for facilitating $5 billion in illicit transactions.
Phantom's "failure to disclose its direct integration with OKX" was "deceptive," the suit argued.
The plaintiffs are seeking at least $3.1 million in damages, claiming Phantom violated the Commodity Exchange Act by operating as an unregistered trading platform while evading regulatory oversight through "superficial claims of decentralization."
Phantom has not yet issued a public response to the allegations. Murphy and OKX did not immediately return Decrypt's request for comments.
Edited by Sebastian Sinclair
Editor's note: Adds comment from Phantom
