A Solana wallet tested a fake address with $10, then sent it $30,750
Lookalike cost addresses focused practically 4.5 million Solana wallets over 11 months, based on blockchain-data agency Bitquery’s Oct. 9, 2026 findings. The findings present why a profitable small take a look at switch can nonetheless precede a a lot bigger cost to a scammer.
The approach, often called address poisoning, vegetation a deceptive entry in a wallet’s cost historical past. A tiny incoming switch places the sender’s lookalike address close to a professional cost. If the person later copies that address, they will ship cash to the flawed recipient.
A Solana take a look at switch can attain the flawed address
Bitquery describes a Nov. 17, 2025 case by which a wallet first paid $10 in USDT to its Gate.io deposit address. A lookalike sent mud 12 seconds later. The wallet then sent a second $10 take a look at to the fake, adopted by 30,749.80 USDT to that very same address.
The implication is that a profitable take a look at confirms supply to the chosen address, however can not set up who controls it. If the vacation spot was copied incorrectly, repeating the cost repeats the error.
Receiving mud doesn’t itself drain a wallet on this mechanism. The loss happens when its proprietor subsequently authorizes a cost to the lookalike.
Bitquery counted 4,497,798 focused wallets from Oct. 30, 2025, by Oct. 7, 2026. Its rule required a same-day cost of no less than $1 in SOL, USDC or USDT, adopted by mud or a fake stablecoin token from a totally different address matching no less than three characters at every finish of the payee.
The loss evaluation used a smaller subset: roughly 3.0 million wallets poisoned by July 9, 2026. Of these, 1,104 made qualifying funds totaling $940,106. The wider concentrating on depend doesn’t imply 4.5 million wallets misplaced cash.
The loss complete is a ground. It counts funds of no less than $1 inside 90 days of the primary mud. Beyond that window, a cost may qualify if extra mud arrived that day. Wallets poisoned after July 9 and funds outdoors these guidelines had been excluded. Bitquery additionally eliminated doubtless present relationships, equivalent to pairs with earlier funds or repayments; some real thefts might have been excluded.
Phantom’s address-poisoning guidance advises avoiding addresses copied from transaction historical past and verifying the address earlier than sending.
Its receiving-payment instructions separate the checks: first verify the precise recipient address and community, then search for the transaction standing on an explorer. Phantom additionally says it can not get better tokens sent to the flawed address.
The submit A Solana wallet tested a fake address with $10, then sent it $30,750 appeared first on CryptoSlate.
