A lawsuit has been filed against Phantom Technologies alleging that security vulnerabilities in its Phantom crypto wallet led to the theft of over $500,000 worth of Wiener Doge tokens from a developer’s account.
A cybercriminal allegedly hacked into Thomas Liam Murphy’s personal computer and exported his private key to his Phantom wallets from his web browser’s working memory. The attacker gained unrestricted access to all of the funds in Murphy’s three co-linked Phantom wallets without needing to bypass multi-factor authentication, the complaint claimed. The lawsuit was filed on April 14 in the Southern District of New York by Murphy and 13 other plaintiffs.
The complaint alleges that Phantom exposed users to malware and crypto theft due to fundamental design flaws, despite marketing its security as “best-in-class.” Phantom, valued at over $3 billion and widely regarded as the go-to wallet for Solana blockchain users, allegedly stored users’ private keys in “unencrypted browser memory,” making them vulnerable to extraction by malware. Private keys are cryptographic codes that allow users to access and manage their cryptocurrency.
A Phantom spokesperson stated that the company strongly denies any allegations of wrongdoing and looks forward to demonstrating why the lawsuit should be dismissed. The company said it gives users full control of their funds and can’t prevent scams from malicious links, but works with law enforcement when criminal activity is reported. It also said it offers in-app security education and safety resources.
Murphy claimed he reported the theft to Phantom immediately, but the company responded that it operated “a noncustodial wallet,” which meant that Murphy bore “sole responsibility” for any loss of his crypto. As a major crypto wallet, Phantom hosts assets worth approximately $25 billion across 10 million active users, the lawsuit claims.
The lawsuit further alleges that a cybercriminal used Phantom’s built-in “Swapper” feature to liquidate Wiener Doge tokens worth approximately $500,000 for only $37,537 in Solana. The “Swapper” feature allows users to exchange one cryptocurrency for another directly within the wallet. This mass liquidation allegedly destroyed the value of the entire Wiener Doge project, which had reached a market capitalization of $3.1 million at its peak.
The complaint also alleges that Phantom “lacked any system for transaction velocity checks, geolocation anomalies, or withdrawal limits,” comparing the Solana wallet to how Coinbase wallets operate. The suit names OKX, a crypto exchange that partnered with Phantom, citing OKX’s guilty plea to federal money laundering charges for facilitating $5 billion in illicit transactions. Phantom’s “failure to disclose its direct integration with OKX” was “deceptive,” the suit argued.
The plaintiffs are seeking at least $3.1 million in damages, claiming Phantom violated the Commodity Exchange Act by operating as an unregistered trading platform while evading regulatory oversight through “superficial claims of decentralization.” Phantom has not yet issued a public response to the allegations beyond stating that the claims are without merit.
