Address Poisoning Scams Target Millions of Solana Wallets
A new wave of address poisoning campaigns has deceived users into transferring funds to scam accounts.
Updated on Oct. 12, 2026 in Cybersecurity
Live Poll
Do you trust your own ability to verify cryptocurrency addresses before sending payments?
Between October 2025 and October 2026, address poisoning tactics targeted 4,497,798 Solana wallets by inserting fake addresses into transaction histories. These lookalike addresses tricked 1,104 users into sending at least $940,106 in cryptocurrency to unauthorized accounts.
Why it matters
The campaign highlights an persistent vulnerability in user interface trust, where transaction history is exploited to mirror legitimate addresses. This strategy effectively bypasses traditional security by relying on human error rather than technical protocol exploits.
The poisoning method delivers a dust transfer, placing a scammer's lookalike address in the user's history, leading to accidental fund redirection. In one case, a user lost 30,749.80 USDT after a test transfer, demonstrating the efficacy of the tactic.
The players
Solana
A high-throughput blockchain network designed for decentralized applications and cryptocurrency transactions.
Phantom
A popular multi-chain crypto wallet that allows users to store, buy, and swap assets across the Solana ecosystem.
Bitquery
A blockchain data and analytics firm that provides infrastructure for parsing and visualizing on-chain network activity.
The details
Address poisoning works by sending a tiny, often zero-value, dust transfer to a target wallet from an address that mimics a common recipient. When a user checks their transaction history to repeat a previous payment, they inadvertently copy the attacker's lookalike address instead of the legitimate one. This technique relies on users trusting their own recent transaction logs as a source of truth for valid destination addresses.
Timeline
Oct 30, 2025 – Oct 7, 2026: Targeted period for 4,497,798 Solana wallets.
Nov 17, 2025: A wallet lost 30,749.80 USDT in a specific scam case.
July 9, 2026: End date for the study's loss analysis subset.
Oct 9, 2026: Date of Bitquery findings release.
The Tech Race
This campaign follows a pattern established by earlier Ethereum-based poisoning exploits, marking the continued evolution of social engineering within wallet interfaces. It serves as a reminder that as blockchain throughput increases, the security burden shifts from the protocol to the user interface.
Users can mitigate risk by manually verifying full public addresses rather than copying them directly from recent transaction history. Phantom and other developers continue to advise that wallet history should not be treated as a primary or authoritative address book.
The takeaway
This trend confirms that attackers are shifting focus toward exploiting the trust users place in their own wallet's UI logs. Users should verify every character of a destination address before confirming a transfer to prevent loss.
Further reading
For more on the evolving tactics of blockchain-based social engineering, explore our Cybersecurity section.
Live Poll
Do you trust your own ability to verify cryptocurrency addresses before sending payments?
