You asked to unstake a small amount, or a portion of your stake, and your wallet is asking you to approve something that looks much bigger than what you requested.

For example, unstaking 1 SOL from a 40 SOL position can produce an approval screen like this:

The exact wording depends on which wallet you use, but the shape is the same: amounts larger than you asked for, a deposit into another stake account, and an address you do not recognise.

This is normal for an Instant Unstake from a native staking position, and you were right to stop and check. Here is what each part is.

Solana stake accounts are handled as whole units. If your 40 SOL sits in a single stake account and you ask to unstake 1 SOL, the transaction has to involve that whole account: the portion you asked for goes to the buyer, and the remainder is placed back into a stake account that is still yours.

The large numbers are the account being handled, not the amount you are giving up.

That is your remaining stake going back into a stake account you own. It stays delegated and keeps earning. Nothing is being moved away from you.

Instant Unstake pays you immediately instead of making you wait an epoch. For a native staking position, it does that through a marketplace of liquidity providers who take over your stake and send SOL back.

The unfamiliar address is the liquidity provider buying your stake. Your wallet has no way to know who that is, so it displays it as unknown. The exchange happens in a single transaction, so either every part completes together or none of it does. There is no moment where someone holds your stake without you having been paid.

Some wallets go further than showing an unfamiliar address. Phantom, Jupiter and similar wallets can show a red warning that says something like "This transaction is likely malicious" or "this transaction has been flagged as malicious", followed by "this transaction transfers withdrawal control of your stake account to [address]. They could withdraw your entire stake."

The screenshot above shows a real example: picaXW…fHNiQB. That address belongs to a liquidity provider taking the other side of your unstake, not an attacker. The exact address will be different on your own transaction, since it depends on which liquidity provider fills your order.

Notice the line below the warning showing SOL arriving in your wallet. That is your payout, and it settles in the same transaction as the stake handoff. It should match the amount the app showed you before you pressed Unstake.

This is the same mechanism described above, just flagged more aggressively. The wallet flags it because the liquidity provider address is not one it recognises, and it cannot tell the difference between a liquidity provider taking over your stake as part of an unstake you started and an attacker attempting the same thing, so it warns about both identically. Marinade never transfers more than the amount you requested. The remainder returns to a stake account you own.

We are in touch with wallet teams, including Jupiter, to get these liquidity provider addresses recognised so the warning stops appearing.

The checklist below still applies: if you started this unstake yourself on app.marinade.finance and the amount matches what you expect to receive, it is safe to approve. If you would rather not approve a screen with this warning at all, use Delayed Unstake instead. There is no liquidity provider and no address handoff, so your wallet shows an ordinary confirmation. See "Delayed Unstake Looks Different" below.

Before approving, check the estimated SOL you will receive shown in the Marinade app. That figure is the one that matters, not the internal amounts your wallet lists.

Instant Unstake works differently for mSOL. There it is a swap from mSOL to SOL routed through decentralized exchanges, so no stake accounts move and you will not see this screen.

Marinade Borrow shows the same screen. Opening a borrow position converts a native stake position into mSOL collateral, which changes the authority on a stake account, so wallets flag it the same way. The explanation above applies there too.

If you use Delayed Unstake, your wallet shows an ordinary confirmation instead: the network fee, and no unfamiliar address. Even when you unstake part of a position, you will not see the withdraw-and-redeposit steps described above.

There is no buyer and no exchange. On Marinade Native and Select, including Native positions using Recipes, Delayed Unstake costs a flat 0.003 SOL, charged from your wallet's SOL balance rather than deducted from the amount you unstake.

Your wallet shows this 0.003 SOL in addition to the network fee.

You do not need to read the transaction to confirm you are getting paid. The wallet's approval screen lists internal stake account movements, not your final result.

Check these three things before you approve:

If those three are right, the approval is safe to sign. Nothing moves until you approve, and if you cancel, nothing has happened.

The exchange is atomic. Either you receive your SOL and the liquidity provider receives the stake in the same transaction, or the whole transaction fails and nothing changes. There is no state where your stake leaves and your SOL does not arrive.

After you approve, your SOL arrives immediately and you can look the transaction up on Solscan using the signature your wallet gives you.

The screen above is expected only because you started an unstake yourself. Cancel immediately if any of these are true:

See Official Links and I Think My Wallet Was Compromised.

Q: Will I lose the rest of my staked SOL?
A: No. Only the amount you asked for is unstaked. The remainder returns to a stake account you own and continues earning.

Q: I cancelled. Did anything happen?
A: No. A cancelled transaction does not execute, and nothing changed. You can start again whenever you are ready.

Q: Can that address take more later?
A: No. The approval covers the single transaction you sign. It does not grant ongoing access.

Q: I used Delayed Unstake and my SOL has not arrived.
A: Check whether you have claimed it. Delayed Unstake does not send SOL back automatically; once the epoch completes, return to the app and claim. If the countdown has not finished yet, it is simply not ready.

Q: Why does Delayed Unstake not show this?
A: Because there is no buyer involved. Your stake deactivates over an epoch and you claim the SOL afterwards.

Q: I entered 0.1 SOL but it looks like it is unstaking 1 SOL. Is this a bug?
A: No. Instant Unstake has a minimum of 1 SOL. Delayed Unstake on Marinade Native has no such floor. If you enter less than that, the app is meant to show a warning with the nearest amount you can actually unstake, letting you adjust before anything happens. Check the estimated SOL you will receive shown in the app, that is the real amount, nothing moves until you confirm.

Q: My wallet says the transaction is likely malicious. Should I still be worried?
A: Not if you started the unstake yourself on app.marinade.finance and the amount matches what you expect to receive. Some wallets word this warning aggressively, but it describes the same liquidity-provider handoff explained above, not a separate problem. If the warning still makes you uncomfortable, Delayed Unstake avoids it entirely, at the cost of about one epoch's wait.

Q: Where in the transaction can I see the SOL being sent back to me?
A: The approval screen shows stake account movements, not a breakdown of your net result, that's expected and not something you need to decode. The number that confirms you're getting paid is the estimated SOL you will receive shown in the Marinade app before you approve. The transaction is atomic: the liquidity provider receiving the stake and you receiving your SOL happen together, or the whole thing fails and nothing changes. Once it confirms, your wallet gives you a signature you can look up on Solscan.