On 17 November 2025, a Solana wallet sent $10 in USDT to its deposit address at Gate.io.
Twelve seconds later, a fake address appeared in its transaction history.
Two minutes after the fake appeared, the wallet sent a second $10 test payment to it. A minute and a quarter later, it sent 30,749.80 USDT to the lookalike.
The sequence is an example of address poisoning, a scam that relies on people copying payment destinations from their transaction histories. Users commonly check only the first four to six characters and the last four to six characters of an address before transferring funds.
Attackers create a vanity address with the same starting and ending characters as the intended destination. They then execute a 0-token transfer from the victim's address to the malicious lookalike, creating an on-chain record that can appear in the activity feeds of wallets including Phantom.
Bitquery counted 4,497,798 Solana wallets touched by lookalike payment addresses during 11 months, from 30 October 2025 to 7 October 2026. The campaign used 9.4 million fake addresses to reach those wallets.
On the median day, the dust transfer arrived 18 seconds after the real payment, and three in four such transfers appeared within a minute. About 42,000 wallets received dust on the median day, while roughly 305,000 wallets received it on ten days or more.
The fraudulent transfer did not always follow immediately. Only one payment in ten to a lookalike arrived within an hour of the first dust transfer, while a quarter came within a day.
Another wallet paid SOL to its Crypto.com deposit address on 3 December 2025, received dust, and sent $166,330 in SOL to the lookalike less than an hour later. That fake matched the real deposit address on its first four and last four characters: HJ7f at the start, rYEz at the end.
Of roughly 3.0 million wallets poisoned before mid-July 2026, 1,104 later sent at least a dollar to a fake address, Bitquery found. Bitquery put Solana's counted loss from address poisoning at $940,106.
Crypto transactions are usually final, with typically no chargeback mechanism.
Comments (0)