# Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses

- Severity: Critical · Status: Still active (live)
- Chains: Solana · Method: Address poisoning
- Started: Nov 17, 2025 · Last update: Oct 12, 2026 · Reported stolen: $940K · Victims: 1104
- Who/what: Solana wallet users sending to exchange deposit addresses

Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history.

## Am I affected?
You are a target if your Solana history shows tiny incoming transfers (often a fraction of a cent of USDC, USDT or SOL) from addresses that start and end like an address you pay often, such as your exchange deposit address. You lost money only if you sent a payment to one of those lookalikes.

## What to do now
- Compare the full address of your recent large sends with the deposit address shown in your exchange account right now.
- If you paid a lookalike, report the scam address to the exchange whose address was copied. Wallets like Phantom cannot reverse Solana transfers.
- Do not interact with the dust transfers or any links that come with them.

## How to avoid this
- Never copy a recipient from transaction history. Use a saved contact or copy it fresh from the exchange's deposit page.
- Check the whole address, not just the first and last four characters.
- A 'successful' test transfer only proves the address exists, not who owns it. Confirm the test actually arrived in your exchange account before sending the rest.

## Sources
- A Solana wallet tested a fake address with $10, then sent it $30,750 (CryptoSlate, 2026-10-12): https://cryptoslate.com/?p=571247

Full record: https://drains.watch/i/solana-address-poisoning-wave-2025-2026 · JSON: https://drains.watch/i/solana-address-poisoning-wave-2025-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.