A Solana wallet tested a fake address with $10, then sent it $30,750
A Solana wallet fell victim to an address poisoning scam, losing over $30000 after testing a fake lookalike payment destination found in its transaction history.
Nearly 4.5 million Solana wallets faced targeting by lookalike payment addresses over an 11-month period, based on data released by blockchain-analytics firm Bitquery on Oct. 9, 2026. These insights highlight why completing a successful small test transaction can still lead a user to send a much larger sum to a fraudster.
This tactic, known as address poisoning, inserts a deceptive entry right into a user’s transaction history. A tiny incoming transfer places the sender’s fraudulent, lookalike address directly adjacent to a legitimate payment destination. If the account holder later copies that address from their recent activity, they inadvertently route funds to the wrong recipient.
A Solana test transfer can reach the wrong address
Bitquery documented an incident from Nov. 17, 2025, where a wallet initially transferred $10 in USDT to its correct Gate.io deposit destination. Just 12 seconds later, a lookalike account sent a small dust transaction. The wallet owner then executed a second $10 test transfer to the fraudulent address, followed by a much larger transfer of 30,749.80 USDT to that exact same erroneous destination.
This scenario demonstrates that while a successful test verifies that funds reached the selected address, it cannot prove who actually controls it. Should the destination be copied incorrectly the first time, repeating the transfer simply perpetuates the error.
Merely receiving a dust transfer does not automatically drain a user’s wallet through this scheme. Financial losses happen only when the account owner willingly approves a subsequent payment destined for the lookalike address.
Bitquery recorded a total of 4,497,798 targeted wallets between Oct. 30, 2025, and Oct. 7, 2026. Their identification criteria required a same-day transfer of at least $1 in SOL, USDC, or USDT, succeeded by either dust or a counterfeit stablecoin token originating from a separate address that shared at least three matching characters at both the beginning and the end of the payee string.
To analyze financial damages, researchers evaluated a narrower pool consisting of roughly 3.0 million wallets impacted up through July 9, 2026. Within that group, 1,104 users made qualifying transfers amounting to a cumulative $940,106. The broader targeting metric does not mean that all 4.5 million wallets suffered financial losses.
This recorded loss figure serves as a baseline minimum. It accounts for transfers of $1 or more executed within a 90-day window following the initial dust arrival. Beyond that timeframe, a payment could still qualify if additional dust hit the wallet on that specific day. Wallets targeted after July 9, alongside transactions falling outside these specific parameters, were left out of the calculation. Bitquery also filtered out probable pre-existing connections, such as pairs with prior payment history or repayments, meaning some legitimate thefts might have been omitted from the final tally.
Official guidance from Phantom regarding address poisoning recommends refraining from copying addresses directly out of transaction histories and explicitly verifying destination details prior to sending any assets.
Phantom’s instructions for incoming payments break the verification process down into distinct steps: first, double-check the precise recipient address alongside the correct network, and second, search the transaction status on a blockchain explorer. Furthermore, Phantom notes that it cannot retrieve tokens sent to an incorrect address.
Frequently Asked Questions
01What is address poisoning in crypto?
Address poisoning is a scam technique where fraudsters send tiny amounts of cryptocurrency (known as dust) or fake tokens to your wallet from an address that closely mimics a legitimate one you frequently use. The goal is to trick you into copying the wrong address from your transaction history.
02Does receiving dust drain my wallet automatically?
No. Simply receiving dust or fake tokens does not grant anyone access to drain your wallet. You only lose funds if you manually authorize a transfer to the lookalike address.
03How can I protect myself from lookalike addresses?
Never copy and paste addresses directly from your transaction history. Always verify the full address character-by-character against a trusted source before sending any funds.
