Blockchain data firm Bitquery revealed on Oct. 9, 2026, that lookalike address poisoning scams targeted 4,497,798 Solana wallets between Oct. 30, 2025, and Oct. 7, 2026, causing nearly $1 million in verified stolen funds. The findings demonstrate how victim test transactions fail to protect users when copying addresses directly from transaction histories.
How a $10 Test Led to a $30,750 Loss
Bitquery documented a specific case from Nov. 17, 2025, where a wallet user transferred a $10 USDT test payment to their legitimate Gate.io deposit address. Exactly 12 seconds later, an attacker's lookalike address sent a dust transaction to the victim's wallet. The user then initiated a second $10 test payment—unknowingly copying the scammer's lookalike address from their transaction history—and immediately followed it with a payment of $30,749.80 USDT directly to the fraudster.
Address poisoning plants a deceptive entry into a wallet's history by matching at least three characters at both the beginning and end of a genuine payee address. While receiving dust or fake tokens does not drain a wallet, financial loss occurs when a user manually authorizes a subsequent transfer to the lookalike address.
Tracking $940,106 in Solana Address Scams
Bitquery's methodology defined targeting rules requiring a same-day transfer of at least $1 in SOL, USDC, or USDT, followed by dust or fake stablecoin tokens from matching vanity addresses. In a subset analysis of approximately 3.0 million wallets poisoned through July 9, 2026, at least 1,104 wallets made qualifying payments to scam addresses totaling $940,106. This loss figure represents a baseline floor, as payments made outside 90-day windows or beyond specific rule parameters were excluded.
This report follows separate findings from a recent Bitquery study on Solana sandwich bots, underscoring how automated scripts exploit user activity across the ecosystem. Wallet provider Phantom issued address-poisoning guidance advising users to avoid copying addresses from transaction histories, verify both destination network and recipient address, and confirm transaction status on a block explorer. Phantom noted it cannot recover tokens sent to incorrect addresses.
Key Takeaways
- 4,497,798 Solana wallets were targeted by address poisoning between Oct. 30, 2025, and Oct. 7, 2026.
- A subset of 1,104 poisoned wallets transferred a floor total of $940,106 to lookalike scam addresses.
- One victim lost $30,749.80 USDT on Nov. 17, 2025, despite conducting two $10 test transactions.
Why It Matters
Address poisoning exploits human operational habits rather than underlying cryptographic vulnerabilities, rendering traditional safety practices like small test transfers useless if users copy destination strings from transaction logs. As vanity address generation tools become cheaper and faster, user interface design in non-custodial wallets must evolve to visually flag unverified history entries or auto-label trusted addresses. Until wallet software systematically alerts users to lookalike characters, self-custody traders remain highly exposed to irreversible human error.
