A $10 transfer to a lookalike Solana address came before a $30,749.80 USDT payment. Bitquery counted nearly 4.5 million targeted wallets, but its loss analysis covered a smaller group; the dust transfer alone did not give the attacker control of the wallet.
On Nov. 17, 2025, the wallet sent $10 in USDT to its Gate.io deposit address. That payment reached the intended destination. Twelve seconds later, a lookalike address sent dust to the wallet. The owner then sent another $10 test payment to the fake address, followed by 30,749.80 USDT to the same destination.
How the trap worked
Bitquery's case study records that sequence. A successful first test did not protect the wallet once the fake address appeared in its transaction history.
In a 2024 campaign analyzed by Chainalysis, attackers created 82,031 lookalike addresses targeting 2,774 wallets; only 0.03% of the fake addresses received more than $100.
This is address poisoning. An attacker tracks public transfers, then seeds a wallet's recent history with a similar-looking address by sending a small transfer or fake token. If the owner later copies an address from that history without checking the full destination, the payment can go to the attacker.
The dust transfer itself does not drain the wallet or give the scammer control. The loss happens only if the owner authorizes a payment to the lookalike address. A test confirms that a transaction reached the selected address. It cannot confirm who controls that address or whether it belongs to the intended recipient.
Address poisoning exploits the way people use transaction history, not a flaw that lets an attacker take control of a wallet. Checking only the first and last few characters is not enough because those are precisely the parts an imitator can make look familiar.
What Bitquery counted
From Oct. 30, 2025, through Oct. 7, 2026, Bitquery reported 4,497,798 targeted wallets. Its detection rule required a same-day payment worth at least $1 in SOL, USDC or USDT. That payment had to be followed by dust or a fake stablecoin token from a different address, matching at least three characters at both ends of the payee address.
That figure counts wallets matching Bitquery's targeting criteria, not confirmed victims. For its loss analysis, the firm examined a smaller group of approximately 3.0 million wallets poisoned through July 9, 2026. It identified 1,104 wallets that made qualifying payments, totaling $940,106.
Bitquery's loss figure is a floor, not a complete estimate of all possible theft. The analysis counted payments of at least $1 made within 90 days of the first dust transfer. A later payment could qualify if more dust arrived that day. Wallets poisoned after July 9 and payments outside those rules were excluded. The firm also left out pairs that appeared to have an existing relationship, such as earlier payments or repayments. Some genuine thefts may therefore be missing from the count.
The 4.5 million figure does not mean 4.5 million wallets were drained. The reported $940,106 also does not cover every possible case under the technique.
Checks that matter
Phantom's address-safety guidance tells users not to copy recipient addresses from transaction history and to verify the address before sending. Its payment instructions separate recipient checks from transaction-status checks: confirm the exact address and network first, then use a blockchain explorer to see whether the transaction was recorded. Phantom also says it cannot recover tokens sent to the wrong address.
The hardware-wallet implant case followed a different attack path. Here, the owner selected a misleading address from transaction history. Address poisoning requires no compromised device: the user can initiate and sign the transfer themselves.
A small test can confirm that a transaction reaches a selected destination, but it cannot verify that destination's identity. Wallet interfaces and explorers can show where funds went; they cannot establish that the address belongs to the person or service the sender intended. Check the complete address against a trusted source before signing, rather than relying on a partial visual match or a successful test.
Address poisoning also differs from sandwich attacks, another risk covered in Solana on-chain analysis. From Oct. 30, 2025, to Oct. 7, 2026, Bitquery identified about 6.9 million sandwich attacks by 2,545 bot wallets against roughly 2.2 million wallets. Those attacks worsen trade execution within the slippage a user permits rather than taking control of a wallet. Bitquery cautioned that on-chain records alone cannot prove a bot saw a specific order in advance. Some identified addresses could belong to fast traders rather than automated bots.
