{
 "tag": "dusting",
 "name": "Dusting",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-4556-eth-jan-2026",
   "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum whale wallet",
   "tags": [
    "ethereum",
    "address-poisoning",
    "eth",
    "dusting",
    "lookalike-address",
    "tornado-cash",
    "scam-sniffer",
    "whale"
   ],
   "amountUsd": 12250000,
   "victims": 1,
   "startedAt": "2026-01-30",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-01-31T12:00:00Z",
   "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss."
  },
  {
   "slug": "solana-address-poisoning-wave-2025-2026",
   "title": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026",
   "json": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "address-poisoning",
   "product": "Solana wallet users sending to exchange deposit addresses",
   "tags": [
    "solana",
    "address-poisoning",
    "dusting",
    "usdt",
    "usdc",
    "phantom",
    "exchange-deposit",
    "bitquery"
   ],
   "amountUsd": 940106,
   "victims": 1104,
   "startedAt": "2025-11-17",
   "closedAt": null,
   "updatedAt": "2026-10-12T12:00:00Z",
   "summary": "Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history."
  }
 ],
 "changes": [
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-12",
   "title": "CryptoSlate reported that 1,104 wallets in a studied subset paid $940,106 to poisoned addresses, described as a minimum.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Bitquery published findings that 4,497,798 Solana wallets were targeted with lookalike addresses over about 11 months.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-11-17",
   "title": "A Solana wallet sent a $10 USDT test to its Gate.io deposit address; 12 seconds later a lookalike sent dust, and the wallet then sent 30,749.80 USDT to the lookalike.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  }
 ]
}