Common Solana Scam Patterns in 2026

Solana scams change their story all the time. There's a new narrative, a new team, a new Telegram group. The mechanics underneath change much less, and there are only a handful of them. If you learn how each one works, you can spot the next version without having seen it before. Solana also publishes its own guide to staying safe.

Live mint authority on a "fixed supply" token

If a token is sold as fixed or capped supply but its mint authority was never revoked, whoever holds that authority can mint more at any time. Every holder gets diluted, and nobody's permission is needed.

You can check this in seconds. Any wallet or explorer shows a mint's current authority fields. If the project says the supply is fixed and the mint authority still shows an address, the claim is false today, whatever the team has said. How to revoke mint and freeze authority shows what a revoked authority looks like on-chain.

Live freeze authority

A live freeze authority lets its holder freeze any wallet's balance of the token, including yours after you buy. Fewer people check this field than mint authority. A token can have its mint authority revoked and still keep a freeze authority nobody mentioned, so look at both.

Honeypots: tokens you can't sell

A honeypot lets you buy but not sell. On Token-2022 this is usually done with a TransferHook extension that runs a custom program on every transfer. On older tokens it can be other non-standard program logic. Either way, the program allows transfers from the deployer's addresses and fails or blocks everyone else's.

The sign is usually indirect. You see normal-looking buys and almost no successful sells from any wallet except the deployer's. Volume alone won't show it. Look through the transaction history for real selling by ordinary wallets.

Fake approval requests

A site dresses up a token delegation approval as something harmless, with a button that says "claim", "verify" or "connect". How wallet-drainer contracts work covers this in more depth. The defence is always the same: read what your wallet's confirmation screen says the transaction does, and ignore the label on the button that opened it.

Copycat tokens

Anyone can create a token with the same name and symbol as a well-known one, often with a similar logo, and wait for buyers who search by name. Names and symbols aren't unique on-chain. The only check that works is the mint address, copied from the real project's own site or docs. Don't take it from a search result or a link someone posted in a chat.

Concentrated supply made to look spread out

When a few wallets hold most of the supply, a small group can sell into everyone else's buying. Sometimes that supply is split across many wallets run by the same party, so no single whale shows up.

A holder snapshot shows concentration, but you have to read it with some care. Liquidity pools and treasury wallets are large holders too. Look at which addresses hold the big balances, and don't treat the top-holder percentage as the whole answer.

Urgency and claims you can't check

Almost every scam above comes with the same social layer. There's time pressure ("claim expires soon"). There are claims nobody can check, like "audited" with no report linked, or "doxxed team" with no way to confirm anyone's identity. And there's a push to act before you look. None of these proves a scam by itself. When you see them, slow down and check the things you can check: authorities, holder distribution and real transfer history.

You can check all of this yourself

Every pattern here shows up in public on-chain data. You don't need inside information or anyone's word. Account Inspector reads a mint's authorities, supply and metadata directly. A holder snapshot shows concentration. Transaction Inspector decodes any transaction you're unsure about. The authorities and revocation docs explain each authority field and what a revoked one looks like.