Solana Address Poisoning: How Dust Lookalikes Steal

Your wallet history just got a tiny incoming transfer from an address that looks like the exchange deposit you've paid a dozen times. First four characters match. Last four match. The middle is different, but most apps hide that. If you copy from history next time you top up, the funds go to the lookalike. That is Solana address poisoning.

Solana address poisoning does not need your seed phrase, a malicious signature, or malware on your phone. It bets on a habit: copying a destination from recent activity instead of from the real source. I'll walk through how the scam works, what Bitquery's on-chain study measured across roughly eleven months of Solana transfers (figures checked 9 October 2026), and the habits that shut it down. Sources are linked so you can check me.

What is Solana address poisoning?

A Solana address is a long base58 string. Wallet UIs usually shorten it to the first few and last few characters. People also reuse destinations—an exchange deposit, a savings wallet, a counterparty they pay often—and many copy those from the last payment that "looked right."

Poisoning uses both shortcuts. An attacker watches the chain for a real payment, generates a vanity address whose ends match the destination you just paid, then sends you dust (a tiny SOL, USDC or USDT transfer, often worth less than a cent) from that lookalike. The dust puts the fake next to the real payment in your history. Weeks later, when you copy from history, you may paste theirs. The transaction is valid. You signed it. Keys were never stolen.

Bitquery's definition is tight: after a wallet pays someone at least a dollar in SOL, USDC or USDT, a different address sharing at least the first three and last three characters of that payee sends the payer dust. That is the poison event. A later payment of at least a dollar from the poisoned wallet to that lookalike counts as a loss in their study.

How does the dust get into your history?

The loop is fast and boring, which is why it scales:

• Watch. Bots read new payments. Recurring destinations (exchange and gambling deposit addresses show up a lot in the loss data) are especially useful because people pay them again.
• Match the ends. A vanity keypair is generated until the address starts and ends like the real payee. In Bitquery's cases, most lookalikes matched four or more characters at each end; the rest matched three.
• Send dust. Median delay on a typical day: about 18 seconds after the real payment. Three in four dust transfers landed within a minute. About 80% of poisoned wallets got a tiny real SOL transfer; roughly one in five also (or instead) got tiny real USDC/USDT. Fake "USDC/USDT" tokens were rare on Solana in this dataset—about 1 in 1,000 cases—because real SOL dust is cheap enough.
• Wait. Only about one in ten lookalike payments came within an hour of the first dust. The median wait was seven days. About 28% came more than thirty days later. The trap is patient.

Nothing here freezes your account or drains an approval. The danger is only that the lookalike sits where your thumb goes when you copy.

How big is this on Solana?

Bitquery counted 4,497,798 Solana wallets poisoned between 30 October 2025 and 7 October 2026—about 42,000 on the median day, with a peak day above 80,000. About 9.4 million lookalike addresses sent that dust. Roughly 305,000 wallets were hit on ten or more days.

Falling for it is rarer than getting dusted, but the dollars concentrate. Of about 3.0 million wallets poisoned up to 9 July 2026 (so each had a 90-day window), 1,104 later sent at least a dollar to a lookalike—about 1 in 2,750. Together they sent $940,106 (Bitquery treats that as a floor). The median payment to a fake was about $50; the twelve largest payments carried 62% of the money. One December 2025 case alone sent about $166,330 in SOL to a lookalike of a Crypto.com deposit address less than an hour after the dust.

Where the copies pointed: about 40% of stolen dollars went to lookalikes of exchange deposit addresses (labels Bitquery marks, often Binance and Bybit in their data). Another chunk went after gambling-site deposits. Large exits often hopped through chains of fresh wallets in seconds—nineteen of the twenty biggest lookalikes moved funds that way in Bitquery's trace, median about 43 seconds across ten hops.

Same scam shape exists on Ethereum. Bitquery's parallel Ethereum window found more wallets targeted and far larger dollar losses. Treat cross-chain comparisons as rough; the methods differ slightly. The habit is the same.

What habits actually stop it?

Hardware wallets do not save you here. You are the one approving a send to an address you chose. The fix is operational:

• Never copy a destination from recent activity. Pull it from the exchange deposit page, the counterparty's message, or your own receive screen—every time.
• Use an address book for repeats. Phantom, Solflare and others let you save verified contacts. Verify once from the source, then pay from the book so history never enters the loop.
• Check the middle, not just the ends. Ends are what vanity generators copy. A few characters from the middle catch lookalikes that pass a lazy glance.
• Treat stranger dust as a warning, not free money. Ignore it. Some wallets can hide spam tokens; tiny SOL transfers may still show in history, so hiding is not a substitute for the copy rule.
• Do not trust a "test" send if the address came from history. Bitquery documents a case where a ten-dollar test went to the lookalike, arrived, and the main payment followed. A successful test only proves the lookalike works.

This is different from clipboard malware, where spyware on your device swaps an address after you copy it. MetaMask's guidance for that threat is the same practical habit: verify the pasted address before you confirm. Poisoning does not need that malware; it only needs your history. Either way, read the full destination before you sign.

What this doesn't cover

Dust alone cannot move funds out of your wallet. It is bait for a bad copy, not a remote drain. Address poisoning also is not a mint/freeze authority trap, a honeypot sell block, or a fake "support" seed-phrase ask—those are other case files. For launch-side red flags see how to identify suspicious activity in new token launches. For fake sites and support scripts, see how to check if a crypto website is a scam.

Bitquery's loss total is a floor under their rules (minimum dollar sizes, lookalike matching, 90-day windows, exclusions for likely self-pays). Cluster behavior changes; funders go quiet and return. I am not naming a wallet vendor's exact UI truncation length here—check yours. And none of the exchange or gambling labels in the study imply those companies ran the scam; Bitquery marks which deposit addresses were imitated.

The takeaway

Solana address poisoning plants a lookalike in your payment history with cheap dust and waits for you to copy from that history. The ends match on purpose. The middle does not. Scale is huge; successful theft is rarer but real, and a few large mistakes carry most of the dollars. Copy from the source, save repeats in an address book, read the middle characters, and treat unexplained dust as a targeting signal. More plain-words security walkthroughs live in the guides. When you top up an exchange, do you still grab the address from recent activity, or do you open the deposit page every time?

Still building. Still here. 🫡