SolPhishHunter: Towards Detecting and Understanding Phishing on Solana

2025-05-07

AI Summary

Solana’s unique account model and transaction mechanism have enabled a novel class of phishing attacks—termed SolPhish—which evade conventional detection. Method: This paper presents the first systematic taxonomy of three SolPhish attack patterns and introduces SolPhishHunter, the first dedicated detection framework. It integrates a rule engine grounded in account state and transaction semantics, on-chain behavioral modeling, and graph-based analysis to achieve high-precision detection and deep causal attribution. Contributions/Results: (1) We release SolPhishDataset—the first publicly available, academically curated Solana phishing dataset; (2) We detect and validate 8,058 SolPhish incidents, characterizing their spatial-temporal distribution, attacker profiles, and cross-address collusive networks; (3) We quantify associated financial losses at $1,097,000. The dataset is open-sourced, and findings have been disclosed to the Solana community to strengthen ecosystem-wide security resilience.

Technology Category

• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Philosophy and Ethics of AI: Accountability, Interpretability & Explainability

Application Category

• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Algorithmic accountability and transparency on the web

Abstract

Solana is a rapidly evolving blockchain platform that has attracted an increasing number of users. However, this growth has also drawn the attention of malicious actors, with some phishers extending their reach into the Solana ecosystem. Unlike platforms such as Ethereum, Solana has distinct designs of accounts and transactions, leading to the emergence of new types of phishing transactions that we term SolPhish. We define three types of SolPhish and develop a detection tool called SolPhishHunter. Utilizing SolPhishHunter, we detect a total of 8,058 instances of SolPhish and conduct an empirical analysis of these detected cases. Our analysis explores the distribution and impact of SolPhish, the characteristics of the phishers, and the relationships among phishing gangs. Particularly, the detected SolPhish transactions have resulted in nearly $1.1 million in losses for victims. We report our detection results to the community and construct SolPhishDataset, the emph{first} Solana phishing-related dataset in academia.

Problem

• Detecting new phishing types on Solana blockchain
• Analyzing impact and characteristics of SolPhish attacks
• Creating first academic dataset for Solana phishing

Innovation

• Detects SolPhish with SolPhishHunter tool
• Analyzes phishing types and impacts empirically
• Constructs first Solana phishing dataset SolPhishDataset