Common Solana Scam Patterns in 2026

Solana scam patterns rotate in packaging — a new narrative, a new fake team, a new Telegram — but the underlying mechanisms are a short, recurring list. Learning the mechanisms instead of memorizing specific incidents is what actually generalizes.

Live mint authority on a "fixed supply" token

A token marketed as having a fixed or capped supply, where mint authority hasn't actually been revoked, means whoever holds that authority can mint unlimited additional supply at any time — diluting every existing holder without needing anyone's permission. This is checkable in seconds: any wallet or explorer shows a mint's current authority fields. If a project claims fixed supply and mint authority still shows a live address, that claim is currently false, regardless of what's been said publicly. See How to revoke mint and freeze authority for what a genuinely revoked authority looks like on-chain.

Live freeze authority

Similarly, a live freeze authority means the holder can freeze any wallet's balance of that token at will — including yours, after you've bought in. This is a less commonly checked field than mint authority, and worth checking specifically, since a token can have mint authority correctly revoked while still holding a live, undisclosed freeze authority.

Honeypot tokens (sell-blocking logic)

A honeypot is a token you can buy but functionally cannot sell — usually implemented via a custom program the token's transfers route through (relevant specifically to Token-2022 tokens using a TransferHook extension, or non-standard program logic on older tokens) that allows transfers from the deployer's addresses but silently reverts or blocks transfers from everyone else. The tell is usually indirect: normal-looking buy activity with almost no successful sells in the transaction history for any wallet other than the deployer's. Checking a token's actual transfer history for real two-way trading activity, not just volume, is the practical defense here.

Fake token approval requests

Covered in more depth in how wallet-drainer contracts work: a site disguises a token-delegation approval as an unrelated action ("claim," "verify," "connect"). The defense is the same every time — read what your wallet's confirmation screen actually says the transaction does, not the button label that triggered it.

Fake or copycat token addresses

A scam token created with the same name and symbol as a legitimate, well-known token, sometimes even with a visually similar logo, hoping buyers search by name rather than verify the actual mint address. The only reliable check is the mint address itself, copied from an authoritative source (the real project's own site or docs), not from a search result or a link shared in a chat — token names and symbols carry zero uniqueness guarantee on-chain.

Concentrated holder distribution dressed up as organic

A token where a handful of wallets hold the overwhelming majority of supply is structurally set up for a small group to sell into demand generated by everyone else buying — sometimes disguised by spreading the concentrated supply across many wallets controlled by the same party rather than one obvious whale address. Holder concentration is checkable via a snapshot, though it takes judgment to interpret: legitimate LP pools and treasury wallets also show up as large holders, so the raw percentage needs reading alongside which specific addresses hold it, not treated as a single number.

Urgency and unverifiable claims as a pattern, not just a detail

Across almost every category above, the social layer looks similar: time pressure ("claim expires soon"), unverifiable claims ("audited" with no audit report linked, "doxxed team" with no actual identity check possible), and a push toward acting before checking. None of these are proof of a scam individually, but their presence is a reliable signal to slow down and verify the specific, checkable claims — authorities, holder distribution, real transfer history — rather than the unverifiable ones.

The common thread

Every pattern above is checkable using nothing but public on-chain data — no insider information, no trust in anyone's word required. Account Inspector reads a mint's authorities, supply, and metadata directly; a holder snapshot exposes concentration; Transaction Inspector decodes any specific transaction you're unsure about. The authorities & revocation docs cover exactly what each authority field means and what a properly revoked one looks like.