In a new development, a lawsuit was filed on Monday alleging that Phantom Technologies, a leading crypto wallet provider, had substantial security flaws that led to the theft of over $500,000 worth of Wiener Doge (WIENER) tokens from a developer’s account. The lawsuit, lodged by Thomas Liam Murphy, founding partner of crypto law firm Murphy’s Law, and 13 other litigants, maintains that the wallet’s private keys were stored in “unencrypted browser memory,” making them easy prey for malware extraction.
The court document, as obtained by Decrypt, further details the modus operandi of the cybercriminal. The attacker allegedly “hacked into Liam’s personal computer and exported Liam’s private key to his Phantom wallets from his web browser’s working memory,” gaining “unrestricted access to all of the funds in Liam’s three co-linked Phantom wallets” without the need to bypass multi-factor authentication.
Phantom Technologies, with over $3 billion in valuation and widely regarded as the preferred wallet for Solana blockchain users, has been accused of exposing its users to malware and crypto theft due to fundamental design flaws. Moreover, the complaint asserts that despite highlighting its security as “best-in-class,” the company failed to protect its users.
In the aftermath of the theft, Murphy claims that when he reported the incident to Phantom, the company responded by stating that it operated “a noncustodial wallet,” thereby implying that users like Murphy bore “sole responsibility” for any loss of their crypto.
The lawsuit also highlights that Phantom, as a major crypto wallet, hosts assets worth approximately $25 billion across 10 million active users. It alleges that a cybercriminal exploited Phantom’s built-in “Swapper” feature to liquidate Wiener Doge tokens worth approximately $500,000 for a mere $37,537 in Solana (SOL), leading to a significant depreciation in the value of the entire Wiener Doge project.
The complaint specifically points out that Phantom “lacked any system for transaction velocity checks, geolocation anomalies, or withdrawal limits,” drawing a comparison to how Coinbase wallets operate.
Adding to the complexity of the case, the suit also names OKX, a crypto exchange which partnered with Phantom in November 2024. OKX had previously pled guilty to federal money laundering charges related to $5 billion in illicit transactions. The lawsuit argues that Phantom’s “failure to disclose its direct integration with OKX” was “deceptive.”
The litigants are seeking at least $3.1 million in damages, alleging that Phantom violated the Commodity Exchange Act by operating as an unregistered trading platform and evading regulatory oversight through “superficial claims of decentralization.” As of now, Phantom has not issued a public response to the allegations. Decrypt’s request for comments from Phantom, Murphy, and OKX has not been returned so far.
Edited by Sebastian Sinclair.
