Solana Address-Poisoning Scheme Targeted 4.5 Million Wallets

A Solana wallet first sent $10 in Tether (USDT) to a Gate.io deposit address before a lookalike address sent dust, followed by another $10 test payment and a 30,749.80 USDT transfer.

The wallet first sent $10 to a Gate.io deposit address on Nov. 17, 2025. Twelve seconds later, a lookalike address sent a small transfer to the wallet. The wallet then sent another $10 test payment to that address, followed by 30,749.80 USDT.

An 11-month review of Solana transfers identified 4,497,798 wallets that received similar lookalike transfers between Oct. 30, 2025, and Oct. 7, 2026. That count represents wallets exposed to the tactic and does not indicate how many lost funds.

The review found that 1,104 wallets later sent funds to lookalike addresses after receiving an initial dust transfer. Those qualifying payments totaled $940,106, a lower-bound estimate covering wallets poisoned through July 9, 2026, and transactions generally made within 90 days of the first transfer.

The estimate excludes some payments made after the 90-day window, as well as transactions that may have involved existing relationships or self-transfers. The median payment to a lookalike address was $50.

Address poisoning exploits shortened wallet displays that show only the beginning and end of a long blockchain address. Attackers create an address with matching characters, send a tiny transfer and wait for it to appear beside a legitimate payment in the wallet’s transaction history.

A small test payment confirms only that funds reached the address selected by the sender. It does not establish that the address belongs to the intended recipient.

Users should obtain addresses directly from the intended recipient or service, check characters in the middle of the address and confirm the network before sending. They should never copy and paste an address from transaction history.

The tactic was also involved in a prior address-poisoning case involving about $305,000 in DAI losses.