The Phantom crypto wallet is a hot wallet: your keys are decrypted on the device you browse with, so its own June 2024 audit excludes malware from the threat model by design. The cryptography is not the weak part. Your laptop, your phone and whatever you tap approve on are.
Listen to this article, about 14 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 8 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: the sentence in Phantom’s own 7 June 2024 audit that puts malware outside the threat model, the Trustpilot score read on 8 October 2026 and what the accounts behind it actually describe, the hardware wallet list with Trezor and Tangem on the unsupported side, and the one allegation in the lawsuit that its own cited audit contradicts.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. What did the independent audit find in Phantom’s key handling code?
The Least Authority report dated 7 June 2024 reports no issues and two suggestions, a missing BIP32 validity check and a stronger key derivation, both marked Resolved. Read the section
-
2. Which of these sits outside the threat model the audit was given?
The report states that “the threat model does not include compromised devices (e.g., malware being present)”, physical access or network attacks, and says users should ensure those are prevented by other measures. Read it in the threat model section. Read the section
-
3. In the Bitcointalk thread from 7 February 2025, what had to happen before the fake update pop up appeared?
Posters in that thread worked the sequence out between them, and several pointed out that a genuine update never needs the recovery phrase at all. Read the section
-
4. Which hardware wallets does Phantom list as supported?
Phantom’s supported hardware wallets article, read on 8 October 2026, lists named Ledger models and puts all Trezor models, all Tangem models and the Ledger Nano Gen5 on the unsupported side. Read the section
-
5. Which allegation in the complaint is contradicted by the audit the complaint itself cites?
Paragraph 49 of the complaint says there was no such option, while the General Comments of the 7 June 2024 Least Authority audit state that Phantom “also supports hardware wallets”. The rest of the complaint is untested. Read the section
What does the Phantom crypto wallet actually protect?
Phantom is software: a browser extension and a phone app. It generates your keys on your own device and hands you a secret recovery phrase that is yours to look after. Nobody at Phantom can move your coins, and nobody at Phantom can give them back either. That is the trade every non custodial wallet asks you to accept, and Phantom accepts it cleanly. Some phone wallets soften the trade with a cloud copy of the keys, and how the Rainbow wallet backup and its password work shows what that copy still leaves to you.
What it protects well is the key at rest. The independent audit published by Least Authority on 7 June 2024 examined the vault, the BIP39 and BIP32 packages, the mnemonic code and the two storage files, and reported no issues at all. It raised two suggestions, both marked Resolved: a missing validity check in the BIP32 implementation, and a storage encryption key derived with PBKDF2 at 10,000 iterations, SHA256 and a 16 bit salt, which the auditors wrote “does not conform to best practices” because an attacker holding the ciphertext could brute force the password “relatively fast”.
What it does not protect is the moment of use. To sign anything, the key has to be decrypted in the memory of the machine in front of you. The audit records two approaches: on mobile, the React Native library expo-secure-store, and in the browser, “their own secure storage, which is a wrapper of the underlying extension storage”. Both are reasonable engineering. Neither does much if the computer is already working for somebody else. Most pages ranking for this wallet will walk you through the swap screen and the staking tab, and very few mention which of your two devices is actually holding the bag.
What does Phantom’s own security audit leave out?
Here is the sentence worth more than every feature tour written about this wallet. From the threat model section of the 7 June 2024 report: “the threat model does not include compromised devices (e.g., malware being present), physical access to the user’s device by the attacker, network attacks” and vulnerabilities on devices more than two stable versions behind.
Least Authority called that scope reasonable, adding that users should “responsibly ensure that attacks outside of this threat model are prevented by other measures”. That is a courteous way of saying the laptop is your department. This is not a Phantom peculiarity: every browser wallet audit draws the line somewhere, and the same reasoning applies to MetaMask. But it does mean a clean audit of a hot wallet is not a statement about the risk you are carrying, and that is the part the review sites leave on the cutting room floor.
| Threat | Inside the audited threat model | Who carries it in practice |
|---|---|---|
| Flaw in key generation or derivation | Yes, and no issues were reported | Phantom |
| Flaw in the encrypted storage of the key | Yes, one suggestion, marked Resolved | Phantom |
| Malware already running on your computer | No, explicitly excluded | You |
| Someone with physical access to the device | No, explicitly excluded | You |
| A fake page that asks for your recovery phrase | No, not a software flaw | You |
| Approving a transaction that drains an approval | No, you authorised it | You |
One piece of housekeeping, because the review sites keep garbling it. The seed phrase flaw people attribute to Phantom was Halborn’s “Demonic” disclosure, CVE-2022-32969, published in June 2022. The cause sat in the browser: session restore saved the contents of non password input fields to disk unencrypted, so a phrase typed into an ordinary field could be left lying there in plain text. Phantom’s own post says Halborn alerted it in late September 2021 and that “fixes began rolling out in January 2022, and by April, Phantom users became protected”. You will see it quoted as a January 2025 vulnerability report. It is not. January 2025 is the month of the theft in the lawsuit below, which is a different thing entirely.
How do people actually lose coins from a Phantom wallet?
Every guidance page says the same things. What none of them carries is what the people who lost money say happened, so we read it on 8 October 2026.
Phantom’s Trustpilot profile scores 1.5 out of 5 across 103 reviews, 88 percent of them at one star and 8 percent at five. Hold that loosely: the page itself says the profile is unclaimed, reviews are not fact checked and the company has not invited customers to review. People who lose money write reviews; people who quietly keep their coins mostly do not. We read the six most recent reviews there, nineteen replies in one Bitcointalk thread, a second Bitcointalk thread and one discussion on Phantom’s own developer board.
- A reviewer on 6 September 2026 reports being hacked for roughly 2,000 dollars of bitcoin and blames the browser extension.
- A reviewer on 1 June 2026 reports depositing 100 dollars of SOL, paying a 7 dollar fee, and ending up holding a token that Phantom itself later flagged as a scam.
- A Bitcointalk thread opened on 7 February 2025 runs to nineteen replies about a fake extension update pop up asking for the recovery phrase. The posters pin the mechanism down between them: it only appears after the user visits a fake airdrop site, connects and signs a message. Several note that an update never needs the phrase, which is exactly why the request should stop you cold.
- A developer posting on 12 July 2024 downloaded an executable advertised on GitHub as a trading bot, ran it, and three days later found both his MetaMask and his Phantom wallet emptied. He had connected only to official sites. No figure is given in the post.
- On Phantom’s GitHub discussions on 5 December 2024, a user whose transactions were being blocked was told “For this request please contact our support team directly via settings in your Phantom wallet”. Two follow up comments in April 2025 went unanswered. The board is for developers, so the routing is correct, but it is also how a loss feels from the outside.
The pattern is consistent, and it cuts against the headline score. In almost every account where coins actually moved, the compromise happened outside the wallet: a phrase typed into a convincing fake, or malware the reader installed themselves. The accounts that run the other way are about fees, failed swaps and slow support, not stolen keys. This is testimony, not evidence, and a star rating is not a security assessment. What it does tell you is where the risk actually lives.
Can you pair Phantom with a hardware wallet?
Yes, and only with Ledger. Phantom’s supported hardware wallets page, read on 8 October 2026, is unusually specific, and the exclusions matter more than the inclusions.
| Device | Status in Phantom | How it connects |
|---|---|---|
| Ledger Nano X | Supported, mobile app | Bluetooth |
| Ledger Stax, Ledger Flex | Supported, mobile and extension | Bluetooth or cable |
| Ledger Nano S, Nano S Plus | Supported, extension | Cable |
| Ledger Nano Gen5 | Listed as unsupported | Not applicable |
| Trezor, all models | Listed as unsupported | Not applicable |
| Tangem, all models | Listed as unsupported | Not applicable |
| Solana Saga Seed Vault | “Saga is end of support” | Not applicable |
Two lines there are worth a second read. If you own a Trezor, Phantom will not pair with it, and the same goes for a Tangem card, which is one reason the device you already own decides more than the app you prefer. If you are buying a Ledger to pair, check the model against that list rather than against a review, ours included.
Pairing changes the threat model in the only way that matters: signing moves to a device with its own screen, and the recovery phrase never goes near the browser. There is a cost, and Phantom publishes it. Its perps help page states that “Perps are not available when using Ledger wallets”. This site does not recommend perps, staking, lending or any yield product, and nothing here is a view on whether anyone should touch them. The practical point is narrower: the safer key and the busiest screens in the app do not fully coexist, so decide what the account is for before you fund it.
What does the lawsuit against Phantom claim?
Murphy and thirteen others sued Phantom Technologies in the Southern District of New York on 14 April 2025, case 1:25-cv-03060-MMG. The complaint is public, so it is worth quoting rather than paraphrasing through a news desk. It alleges that on 20 January 2025 an attacker took the decrypted private key “from his browser’s working memory”, reached more than 500,000 dollars across three Phantom wallets, and inside five minutes liquidated the lot for 37,537 dollars using the wallet’s own swap feature. Paragraph 4 pleads that Phantom “has long known that its browser application stores decrypted private keys in volatile memory”. The claims are negligence, fraud and deceptive practices. Phantom told Decrypt they are “entirely without merit”.
These are allegations and they are untested. One of them can be checked today, and it does not survive the check. Paragraph 49 asserts there was “no ability for users to opt into safer alternatives like hardware wallet integration or encrypted local storage”. Phantom’s help centre documents Ledger pairing for both the extension and the mobile app, and the General Comments of the very audit the complaint relies on state that Phantom “also supports hardware wallets”. That audit is dated 7 June 2024, more than seven months before the theft. On that one point the pleading and its own cited source disagree, and we flag it because nothing else covering the case has. It is not a defence of anything else in the complaint.
Status, as far as we could establish on 8 October 2026: a Law360 case report dated 28 September 2026 says the court ruled the plaintiffs’ attorney must arbitrate his claims against Phantom. We could not read the order itself, so treat that as reported rather than confirmed and check the public docket for where it stands.
What does a hot wallet hygiene check look like?
None of this needs a view on what anyone should own. It is housekeeping, and it is the part that decides whether the accounts above happen to you.
- Nothing legitimate ever needs the phrase. Phantom’s help centre states that Phantom Support will never ask you to share your secret recovery phrase. An update does not need it. A revoker does not need it. If a page asks, the page is the attack.
- Disconnecting is not revoking. Phantom’s own wording: disconnecting removes an app’s ability to view your wallet, while revoking removes its permission to move certain tokens. Two different buttons, and most people only ever press the first.
- Use the revokers Phantom points at. Its guidance names Famous Fox Revoker for Solana and Revoke.cash for EVM networks. Both ask you to connect a wallet. Neither asks for a phrase.
- Keep a separate wallet for risky connections, holding only what that one job needs. Phantom’s scam avoidance article says the same, and adds not to reach apps through paid search results. Its article on unfamiliar tokens says not to click links inside them: an unexpected token is not a gift.
- Treat an exposed phrase as public. If it has ever been a screenshot, a note app entry or a file in a cloud drive, it is not a backup. Move the coins to a wallet built from a new phrase on a machine you trust.
If the worst has already happened, Phantom’s page on being drained is honest about the limits: it cannot reverse blockchain transactions, freeze assets or recover stolen funds. Its reporting guidance points to the FBI’s Internet Crime Complaint Center at ic3.gov and says to collect the scam links, the destination address and the transaction IDs first. If you are weighing where a hot wallet belongs at all, our guide to choosing a wallet works through it by threat rather than by brand.
Hot wallet hygiene check
Six things to settle before a hot wallet holds anything you would miss. None of them is a view on what you should own, and none of them ever involves typing your recovery phrase into anything.
Ticks are saved on this device only. This is a security checklist, not financial advice.
Frequently asked questions
Is the Phantom crypto wallet custodial?
No. Phantom generates and stores the keys on your own device and gives you the secret recovery phrase, so it cannot move your coins and cannot restore them for you. That also means a loss has no customer service route back.
Can anyone independently check Phantom’s code?
Only partly. The 7 June 2024 Least Authority report names the repositories and git revisions it reviewed, and treated any dependency or third party code as out of scope unless named. Phantom has said it intended to open source its BIP39 seed generation package after audits. Whether the shipping extension can be rebuilt from public source is not something that audit establishes, and we could not confirm it.
Does Phantom support Bitcoin as well as Solana?
Yes. Phantom’s supported networks help article lists Bitcoin, in Native SegWit and Taproot form, alongside Solana, Ethereum, Base, Polygon, Sui and others, and lists several EVM chains as unsupported. Network settings apply to the whole wallet, including accounts added from a Ledger.
Can Phantom freeze or recover coins after a theft?
No. Its own help article states it cannot reverse blockchain transactions, freeze assets or recover stolen funds. Its advice is to disconnect unfamiliar apps, revoke approvals, move anything left to a new wallet and report the incident.
Does pairing a Ledger stop a drainer?
Not on its own. Hardware pairing stops the key being read out of browser memory, which is the attack the lawsuit describes. It does not stop you approving a malicious transaction, because you still confirm that on the device. Reading what the device screen says before pressing the button is the defence there.
Is a 1.5 Trustpilot score a verdict on Phantom’s security?
No, and treating it as one would be a mistake. It reflects 103 self selected reviews on an unclaimed, unverified profile against a user base in the millions, and most of the accounts describe phishing or malware on the reviewer’s own machine rather than a flaw in the wallet. It is useful for learning how losses happen, not for scoring the software.
Finished the page? The same five questions from the top, to see what stuck.
General information about wallet security, not financial advice. Theo Brandt holds no financial qualification and nothing here is a recommendation to buy, sell or hold any asset, or to use any yield, lending, staking or leverage product. Claims were verified on 8 October 2026 against the sources linked above. For your own situation, speak to a qualified professional.
Leave a Reply