SolPhishHunter: Towards Detecting and Understanding Phishing on Solana

TL;DR

This paper introduces SolPhishHunter, a detection tool for Solana-specific phishing attacks, analyzes nearly 8,100 cases resulting in over $1 million in losses, and provides the first academic dataset on Solana phishing.

Contribution

It defines new types of Solana phishing, develops a detection tool, and creates the first academic dataset on Solana phishing activities.

Findings

Detected 8,058 SolPhish instances causing $1.1 million in losses.

Analyzed the distribution, impact, and attacker characteristics of SolPhish.

Provided the first dataset of Solana phishing transactions.

Abstract

Solana is a rapidly evolving blockchain platform that has attracted an increasing number of users. However, this growth has also drawn the attention of malicious actors, with some phishers extending their reach into the Solana ecosystem. Unlike platforms such as Ethereum, Solana has distinct designs of accounts and transactions, leading to the emergence of new types of phishing transactions that we term SolPhish. We define three types of SolPhish and develop a detection tool called SolPhishHunter. Utilizing SolPhishHunter, we detect a total of 8,058 instances of SolPhish and conduct an empirical analysis of these detected cases. Our analysis explores the distribution and impact of SolPhish, the characteristics of the phishers, and the relationships among phishing gangs. Particularly, the detected SolPhish transactions have resulted in nearly \$1.1 million in losses for victims. We report our detection results to the community and construct SolPhishDataset, the \emph{first} Solana phishing-related dataset in academia.