Lookalike payment addresses targeted nearly 4.5 million Solana wallets over an 11-month period, according to blockchain-data firm Bitquery's findings released in October 2026. The research illustrates a common attack pattern in which small test transfers can precede significantly larger payments to fraudulent addresses.
The technique, known as address poisoning, works by placing a misleading entry in a wallet's payment history. A small incoming transfer from a scammer's lookalike address appears near a legitimate payment recipient. If a user later copies that address from their transaction history, they may inadvertently send funds to the wrong recipient.
How the Attack Unfolds
Bitquery documented a November 2025 case demonstrating the vulnerability. A wallet first made a $10 USDT payment to a Gate.io deposit address. Within 12 seconds, a lookalike address sent dust to the same wallet. The wallet then sent another $10 test to the fake address, followed by a payment of 30,749.80 USDT to that same fraudulent destination.
The research shows that a successful test transfer can create false confidence in the recipient address, even though it only confirms that funds reached the selected address, not who controls it. If the destination was copied incorrectly, repeating the payment repeats the error.
Scale of Losses
Bitquery counted 4,497,798 targeted wallets from October 30, 2025, through October 7, 2026. The firm's analysis identified a smaller subset of approximately 3.0 million wallets that received address-poisoning attempts through July 9, 2026. Of those, 1,104 wallets made qualifying payments totaling $940,106.
The wider targeting count does not represent confirmed losses, as many targeted wallets did not authorize payments to the fraudulent addresses. The loss total represents a floor, counting only payments of at least $1 within 90 days of the initial dust transfer.
Wallet Security Guidance
Wallet providers advise users to avoid copying addresses directly from transaction history. Security best practices include verifying the recipient address and network before sending funds, then confirming the transaction status on a blockchain explorer. Users should note that most wallet providers cannot recover tokens sent to incorrect addresses.
