Lookalike fee addresses focused practically 4.5 million Solana wallets over 11 months, in keeping with blockchain-data agency Bitquery’s Oct. 9, 2026 findings. The findings present why a profitable small check switch can nonetheless precede a a lot bigger fee to a scammer.
The approach, often known as handle poisoning, vegetation a deceptive entry in a pockets’s fee historical past. A tiny incoming switch places the sender’s lookalike handle close to a reliable fee. If the person later copies that handle, they’ll ship cash to the incorrect recipient.
A Solana check switch can attain the incorrect handle
Bitquery describes a Nov. 17, 2025 case wherein a pockets first paid $10 in USDT to its Gate.io deposit handle. A lookalike despatched mud 12 seconds later. The pockets then despatched a second $10 check to the faux, adopted by 30,749.80 USDT to that very same handle.
The implication is {that a} profitable check confirms supply to the chosen handle, however can’t set up who controls it. If the vacation spot was copied incorrectly, repeating the fee repeats the error.
Receiving mud doesn’t itself drain a pockets on this mechanism. The loss happens when its proprietor subsequently authorizes a fee to the lookalike.
Bitquery counted 4,497,798 focused wallets from Oct. 30, 2025, by means of Oct. 7, 2026. Its rule required a same-day fee of no less than $1 in SOL, USDC or USDT, adopted by mud or a faux stablecoin token from a special handle matching no less than three characters at every finish of the payee.
The loss evaluation used a smaller subset: roughly 3.0 million wallets poisoned by means of July 9, 2026. Of these, 1,104 made qualifying funds totaling $940,106. The broader focusing on rely doesn’t imply 4.5 million wallets misplaced cash.
The loss whole is a ground. It counts funds of no less than $1 inside 90 days of the primary mud. Past that window, a fee might qualify if extra mud arrived that day. Wallets poisoned after July 9 and funds exterior these guidelines had been excluded. Bitquery additionally eliminated seemingly present relationships, comparable to pairs with earlier funds or repayments; some real thefts could have been excluded.
Phantom’s address-poisoning steerage advises avoiding addresses copied from transaction historical past and verifying the handle earlier than sending.
Its receiving-payment directions separate the checks: first verify the precise recipient handle and community, then search for the transaction standing on an explorer. Phantom additionally says it can’t recuperate tokens despatched to the incorrect handle.
