Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses
Solana wallet users sending to exchange deposit addresses
Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history.
Why this severity: $940K reported stolen, 1,104 victims, still active.
- Started
- Nov 17, 2025
- Chains
- Solana
- Method
- Address poisoning
- Reported stolen
- $940K
- Victims
- 1,104
At risk
- Solana wallet users sending to exchange deposit addresses
- Solana wallets
What to do now
- Compare the full address of your recent large sends with the deposit address shown in your exchange account right now.
- If you paid a lookalike, report the scam address to the exchange whose address was copied. Wallets like Phantom cannot reverse Solana transfers.
- Do not interact with the dust transfers or any links that come with them.
Stay safe
Am I affected?
You are a target if your Solana history shows tiny incoming transfers (often a fraction of a cent of USDC, USDT or SOL) from addresses that start and end like an address you pay often, such as your exchange deposit address. You lost money only if you sent a payment to one of those lookalikes.
What to do now
- Compare the full address of your recent large sends with the deposit address shown in your exchange account right now.
- If you paid a lookalike, report the scam address to the exchange whose address was copied. Wallets like Phantom cannot reverse Solana transfers.
- Do not interact with the dust transfers or any links that come with them.
How to avoid this
- Never copy a recipient from transaction history. Use a saved contact or copy it fresh from the exchange's deposit page.
- Check the whole address, not just the first and last four characters.
- A 'successful' test transfer only proves the address exists, not who owns it. Confirm the test actually arrived in your exchange account before sending the rest.
Timeline 3
CryptoSlate reported that 1,104 wallets in a studied subset paid $940,106 to poisoned addresses, described as a minimum.
SourceBitquery published findings that 4,497,798 Solana wallets were targeted with lookalike addresses over about 11 months.
SourceA Solana wallet sent a $10 USDT test to its Gate.io deposit address; 12 seconds later a lookalike sent dust, and the wallet then sent 30,749.80 USDT to the lookalike.
Source
News & write-ups ›1
How this method works
The attacker sends you a tiny or fake transfer from an address that looks like one you use, hoping you copy it from your history next time you send. Read about address poisoning →
Follow new drains and updates in your feed reader or Telegram RSS bot.