I run automated trading bots on Solana — memecoin sniper, scalp scanner — been running for months with a decent track record.
Woke up this morning to find my wallet completely empty. Here’s exactly what happened, with full on-chain evidence, so others can protect themselves.
What I noticed first
My bot’s hourly snapshot showed all positions as “done” — BONK, PENGU, MEW, WIF all exited. Normal enough, the staircase TP system had fired overnight. But my SOL balance was showing near zero when it should have been around £57-68 worth of SOL sitting idle between trades.
Checked Solscan on my wallet B679niFFxdhs14zUxe65ZKHhSxEXJJmMaMWZMgUqPw1p and found this sequence of transactions at around 21:53 UTC on May 4 2026:
The attack — exact on-chain sequence
Step 1 — SET AUTHORITY calls (the silent part)
Four transactions transferred authority over my token accounts to an unknown address 76XgWFGyVmqVx2QvdXz1:
• MEW — 15,536 tokens (~$9.43)
• WIF — 35.7 tokens (~$6.85)
• PENGU — 800 tokens (~$8.09)
• BONK — 1,555,030 tokens (~$9.76)
This happened silently. No popup, no confirmation I remember seeing. The attacker now controlled those token accounts.
Step 2 — SOL transfer (the drain)
Transaction 3nTzLAXT2fDe292jP4uizrmc6D75qvMRUu5UrDbDsbBFQW4VonwfmWzcZinse67MBc1aC9ibQ7adPMC68TZ8V7BW
Sent 0.802466936 SOL ($68) from my wallet directly to Avdnjm8cvsSzGXmLvZgwmzD2bnTPgX9Ts2rGtd6pNhNd
Gone within seconds. Finalized, confirmed, irreversible.
Step 3 — CLOSE ACCOUNT calls
Multiple closeAccount transactions sent small SOL rent reclaims to 6F3FAgjQLewG3LFbDuxJ — this is standard Jupiter cleanup but happened immediately after the drain, making the timeline look messier than it was.
The attack vector — tPEG
About 10 minutes before the drain, my wallet shows multiple Jupiter swaps involving a token called tPEG via Raydium. I did not consciously buy tPEG. I did not click any links, visit any sites, or approve any airdrops that I’m aware of.
The tPEG token does not appear anywhere in my bot’s codebase. My bot only trades tokens it discovers via DexScreener signals — but tPEG appearing in my wallet suggests either:
1. A malicious transaction was bundled into a legitimate-looking swap I approved without realising
2. My private key was used directly to execute the transaction without my interaction
The tPEG swap routed through Raydium Authority V2 — consistent with what security researchers describe as the drainer’s automated liquidation pipeline, converting stolen tokens to SOL before the final sweep.
The security failure on my end
I’ll be transparent about this because it’s important for others to learn from.
My Solana private key was stored as a plaintext environment variable exported in /root/.bashrc on my VPS. It was also visible in env output. While my server login history showed only my own IP addresses, the key’s exposure in shell environment meant any process running on that server could theoretically read it via /proc.
This is a serious operational security failure. The key should only ever live in a .env file with chmod 600 permissions, never exported as a shell variable.
Full attack pattern — what this looks like on-chain
If you’ve been hit by something similar, look for these signatures in your Solscan transfer history:
• SET AUTHORITY transactions you don’t recognise, transferring token account control to an unknown address
• A large outbound TRANSFER of SOL to an unfamiliar wallet immediately after
• CLOSE ACCOUNT transactions in bulk shortly after
• Unknown token (in my case tPEG) appearing via Raydium/Jupiter swaps just before the drain
This matches the documented “Owner Reassignment” drainer pattern that security researchers flagged as increasingly common in early 2026. The attack bundles a hidden setAuthority instruction into what looks like a routine token swap. Your wallet simulation may show it as benign.
What I’ve done since
• Old wallet fully abandoned — treat it as compromised
• New Phantom wallet generated, fresh seed phrase, written on paper only
• Private key moved to .env file only, chmod 600, removed from all shell config
• Token allowlist being added to bot — only pre-approved contract addresses tradeable
• Bot wallet will be topped up in small amounts only — never hold more than you’re willing to lose in a hot wallet
Attacker addresses for the community to flag
• Drain recipient: Avdnjm8cvsSzGXmLvZgwmzD2bnTPgX9Ts2rGtd6pNhNd
• Token authority transfer target: 76XgWFGyVmqVx2QvdXz1
• Drain tx: 3nTzLAXT2fDe292jP4uizrmc6D75qvMRUu5UrDbDsbBFQW4VonwfmWzcZinse67MBc1aC9ibQ7adPMC68TZ8V7BW
If you’ve seen these addresses before or have been hit by tPEG, please comment below. Tagging u/zachxbt if he’s tracking this drainer family.
TL;DR: Woke up to empty Solana wallet. On-chain forensics showed a setAuthority drainer attack via a token called tPEG. 0.8 SOL (~£68) gone. Private key exposure in .bashrc was likely the vector. Full addresses posted above — stay safe out there.