Crypto Copilot Hides Theft Behind Legit-Looking Solana Swaps

[mendez]

Socket says Crypto Copilot routes swaps through Raydium, then appends a hidden second instruction that steals SOL. Wallet confirmation screens show only the main swap, masking the malicious transfer. Users sign one transaction, but both instructions execute atomically on-chain.

[Nahid Hossen]

Sophisticated scams are now mimicking real DeFi flows — users must double-check everything.