Lookalike payment addresses targeted nearly 4.5 million Solana wallets over 11 months, according to blockchain-data firm Bitquerys Oct. 9, 2026 findings. The findings show why a successful small test transfer can still precede a much larger payment to a scammer.
Related Asset Solana #7 SOL · $110.89 24-hour change: up 1.18% Loading price history… 24H Up 1.18% 7D Down 8.21% 30D Up 8.63%
The technique, known as address poisoning, plants a misleading entry in a wallet‘s payment history. A tiny incoming transfer puts the sender’s lookalike address near a legitimate payment. If the user later copies that address, they can send money to the wrong recipient.
A Solana test transfer can reach the wrong address
Bitquery describes a Nov. 17, 2025 case in which a wallet first paid $10 in USDT to its Gate.io deposit address. A lookalike sent dust 12 seconds later. The wallet then sent a second $10 test to the fake, followed by 30,749.80 USDT to that same address.
Related Asset Tether USDT · Stablecoin
The implication is that a successful test confirms delivery to the selected address, but cannot establish who controls it. If the destination was copied incorrectly, repeating the payment repeats the mistake.
Receiving dust does not itself drain a wallet in this mechanism. The loss occurs when its owner subsequently authorizes a payment to the lookalike.
Bitquery counted 4,497,798 targeted wallets from Oct. 30, 2025, through Oct. 7, 2026. Its rule required a same-day payment of at least $1 in SOL, USDC or USDT, followed by dust or a fake stablecoin token from a different address matching at least three characters at each end of the payee.
Related Asset USDC USDC · Stablecoin
The loss analysis used a smaller subset: approximately 3.0 million wallets poisoned through July 9, 2026. Of those, 1,104 made qualifying payments totaling $940,106. The wider targeting count does not mean 4.5 million wallets lost money.
The loss total is a floor. It counts payments of at least $1 within 90 days of the first dust. Beyond that window, a payment could qualify if more dust arrived that day. Wallets poisoned after July 9 and payments outside those rules were excluded. Bitquery also removed likely existing relationships, such as pairs with earlier payments or repayments; some genuine thefts may have been excluded.
Phantoms address-poisoning guidance advises avoiding addresses copied from transaction history and verifying the address before sending.
Related Product Phantom A friendly Solana crypto wallet
Its receiving-payment instructions separate the checks: first confirm the exact recipient address and network, then look up the transaction status on an explorer. Phantom also says it cannot recover tokens sent to the wrong address.