TLDR
- A lawsuit alleges Phantom wallet’s security vulnerabilities led to theft of $500,000 in Wiener Doge tokens
- Attorney Thomas Liam Murphy and 13 plaintiffs claim Phantom stored private keys in unencrypted browser memory
- The hack and subsequent token liquidation allegedly destroyed the $3.1 million Wiener Doge project
- Plaintiffs seek $3.1 million in damages for violations including operating as an unregistered trading platform
- Phantom denies allegations, stating claims are “entirely without merit”
A lawsuit filed Monday against Phantom Technologies alleges that security vulnerabilities in its crypto wallet led to the theft of over $500,000 worth of Wiener Doge (WIENER) tokens. The stolen funds belonged to attorney Thomas Liam Murphy, who along with 13 other plaintiffs is seeking $3.1 million in damages.
The complaint, filed in the Southern District of New York by crypto law firm Murphy’s Law, claims Phantom exposed users to malware and crypto theft due to fundamental design flaws, despite marketing its security as “best-in-class.”
According to court documents obtained by Decrypt, a cybercriminal “hacked into Liam’s personal computer and exported Liam’s private key to his Phantom wallets from his web browser’s working memory.” This gave the attacker “unrestricted access to all of the funds in Liam’s three co-linked Phantom wallets” without needing to bypass multi-factor authentication.
The plaintiffs allege that Phantom, valued at over $3 billion and widely used by Solana blockchain users, stored private keys in “unencrypted browser memory,” making them vulnerable to extraction by malware.
Phantom has denied these allegations. “We are aware of the lawsuit that has been filed against Phantom, strongly deny any allegations of wrongdoing, and look forward to demonstrating why this lawsuit should be dismissed,” a spokesperson told Decrypt. “The claims in this lawsuit are entirely without merit.”
Security Features in Question
The lawsuit alleges that Phantom “lacked any system for transaction velocity checks, geolocation anomalies, or withdrawal limits,” comparing the Solana wallet unfavorably to how Coinbase wallets operate.
Murphy claims he reported the theft to Phantom immediately, but the company allegedly responded that it operated “a noncustodial wallet,” which meant that Murphy bore “sole responsibility” for any loss of his crypto.
As a major crypto wallet, Phantom hosts assets worth approximately $25 billion across 10 million active users, according to the lawsuit.
The complaint further alleges that the cybercriminal used Phantom’s built-in “Swapper” feature to liquidate Wiener Doge tokens worth approximately $500,000 for only $37,537 in Solana (SOL).
Impact on Wiener Doge Project
That mass liquidation allegedly destroyed the value of the entire Wiener Doge project, which had reached a market capitalization of $3.1 million at its peak, according to data from GeckoTerminal.
The Solana-based meme coin reportedly plummeted from $3.1 per token to under $0.01, as stated in the complaint. The thirteen additional plaintiffs, consisting of Murphy’s friends and family, joined the lawsuit after losing investments in Wiener Doge.
“Phantom did not merely fail to anticipate cyberattacks—it knew exactly how users were being compromised and made a calculated decision to remain silent,” according to the filing.
“Phantom’s leaders knew that the browser wallet stored users’ decrypted keys in active memory. They knew that novice users were routinely targeted by malware, phishing scripts, and rogue extensions.”
OKX Partnership Under Scrutiny
The suit also names OKX, a crypto exchange that partnered with Phantom in November 2024. The complaint cites OKX’s guilty plea to federal money laundering charges for facilitating $5 billion in illicit transactions.
Phantom’s “failure to disclose its direct integration with OKX” was “deceptive,” the suit argued. The plaintiffs claim that “OKX’s integration was the direct enabler of the unauthorized liquidation of Liam’s assets. Without OKX’s routing, pricing, and execution services, the cybercriminal would not have been able to convert Liam’s $500,000 in Wiener Doge tokens to SOL using Phantom’s app.”
The plaintiffs are seeking at least $3.1 million in damages, claiming Phantom violated the Commodity Exchange Act by operating as an unregistered trading platform while evading regulatory oversight through “superficial claims of decentralization.”
Seven major claims are made against Phantom, including operating as an unregistered trading platform, negligence in cybersecurity protection, false advertising, and aiding money laundering through OKX.
Phantom says it gives users full control of their funds and can’t prevent scams from malicious links, but works with law enforcement when criminal activity is reported. It also says it offers in-app security education and safety resources.
Murphy and OKX did not immediately return requests for comments. Phantom has not yet issued an additional public response to the allegations beyond its initial statement denying wrongdoing.
