Address poisoning on Solana: how dust transfers trick you

The short answer

Address poisoning on Solana is a scam where an attacker sends you a tiny transfer, often a fraction of a cent in SOL, from an address that matches the first and last few characters of an address you just paid. It waits in your history until you copy the fake instead of the real address. Bitquery counted 4,497,798 Solana wallets targeted in 11 months to October 2026, of which 1,104 later paid a look-alike and lost at least $940,106. The fix is simple: never copy an address from your history, and check every character before you send.

What is address poisoning?

Address poisoning is a scam that plants a look-alike address in your transaction history so you send money to it by mistake. It needs no access to your wallet. It relies on two habits: most people check only the first and last few characters of a 32 to 44 character address, and most people reuse an address by copying it from a recent transaction.

The attack, step by step:

1. You send SOL, USDC or USDT to someone, often an exchange deposit address. The payment is public on chain within a second.
2. A bot watching the chain looks up, or generates, a keypair whose address starts and ends like the address you paid.
3. Seconds later, that look-alike sends you dust: a tiny amount of SOL, a tiny amount of real USDC or USDT, or a fake token. In Bitquery's Solana address poisoning study, the median dust arrived 18 seconds after the real payment.
4. Your wallet now shows two entries with near-identical addresses. Next time you pay that recipient, you copy from history and pick the wrong one.

Dust is a transfer so small it has no economic purpose; here it exists only to create an entry in your history. A look-alike address is a real Solana address the attacker controls whose visible characters match one you trust.

How common is it, and how much has been lost?

Address poisoning on Solana is very common and mostly fails, but the payments that do go through can be large. These are the documented figures I could verify, as of November 2026:

Measure	Figure	Source
Solana wallets targeted, Oct 30, 2025 to Oct 7, 2026	4,497,798	Bitquery
Look-alike addresses that reached them	9.4 million	Bitquery
Wallets that later paid a look-alike (of about 3.0 million poisoned to July 9, 2026)	1,104, about 1 in 2,750	Bitquery
Minimum counted loss	$940,106 ($600,510 SOL, $269,418 USDC, $70,178 USDT)	Bitquery
Median payment to a look-alike	$50	Bitquery
Largest single case	$166,330 in SOL to a Crypto.com deposit look-alike, Dec 3, 2025	Bitquery
Earlier reported case	$2.91 million, after copying a spoofed exchange deposit address, November 2024	Pine Analytics, citing press reports

A few details from the Bitquery study are worth knowing. Copies of exchange deposit addresses took 40% of the stolen dollars, mostly look-alikes of Binance and Bybit addresses, and copies of gambling-site deposit addresses took 17%. Twelve payments of $10,000 or more made up 62% of the money. Compared with Ethereum over a similar period, Solana users fell for it more often (1 in 2,750 against 1 in 4,891) but lost less per payment ($50 median against $300).

The $940,106 is a floor: it counts payments of at least $1 in SOL, USDC or USDT within 90 days of the first dust, and excludes wallets poisoned after July 9, 2026. The November 2024 figure comes from secondary reporting; I could not find an on-chain write-up of it, so treat it as reported rather than verified.

What does address poisoning look like in your history?

Poisoning shows up as an incoming transfer you did not expect, from an address that resembles one you used, usually right after a payment. Bitquery found that about 80% of poisoned wallets received tiny SOL transfers and about 22% received tiny amounts of real USDC or USDT; fake stablecoins appeared in roughly 1 case in 1,000. These are the variants:

Variant	How it looks in your history	How to spot it
Look-alike SOL dust	"Received 0.00001 SOL" from an address like HJ7f…rYEz	Sender matches the ends of an address you paid, the amount is meaningless, and it arrived seconds after your payment
Tiny real stablecoin	"Received 0.01 USDC" from a look-alike	The mint is the real USDC or USDT, so the token looks legitimate; the sender address is what is fake
Zero-amount token transfer	"Received 0 USDC" from a look-alike	An amount of exactly 0. The SPL Token program has no minimum transfer amount (processor source), so a 0-token transfer from the attacker's own account is valid
Fake token named USDC or USDT	"Received 100 USDC", often with a correct-looking logo	The mint is not EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v (USDC) or Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB (USDT); wallets often hide it as spam
Advertising dust	Tiny SOL from a sender with a .sol or other domain name that reads like a website	Not poisoning, but the same channel: the sender name is an advert. Pine Analytics counted about 6.2 million addresses targeted this way in 14 days in April 2025
Spam token with a URL in its name	A token called "Claim at …" or similar	The name is the attack; covered in what to do with spam NFTs, which applies to spam tokens too

One variant from Ethereum does not carry over. On Ethereum, a zero-value transferFrom can make a fake transfer appear to come from you. On Solana, every token transfer must be signed by the owner or delegate of the account the tokens leave, so an attacker cannot forge an outgoing payment from your wallet. Anything poisoned shows up as incoming.

Why is address poisoning so cheap on Solana?

Address poisoning is cheap on Solana because one attempt costs a fraction of a cent. The base network fee is 5,000 lamports (0.000005 SOL) per signature, and the dust itself is often around 0.00001 SOL. Bitquery's largest case started with dust worth "a hundred-thousandth of a SOL". At those prices an attacker can poison thousands of wallets for the price of one successful theft, which is why a 1 in 2,750 success rate still pays.

Fake tokens are the expensive variant. Sending a token you have never held creates a token account in your wallet, and the sender pays its rent: 0.00148844 SOL for a standard SPL account at today's rate, more for Token-2022. That is roughly 100 times the cost of SOL dust, which fits Bitquery's finding that fake stablecoins were rare. It also means the rent in a spam token account was paid by the spammer, and closing that account sends it to you, as explained below. For the fee basics, see Solana transaction fees explained.

How are look-alike addresses generated?

Look-alike addresses are vanity addresses: the attacker generates random keypairs until one's address matches the characters they want, the same way anyone makes a custom wallet address. A Solana address is the base58 encoding of a random public key, so each fixed character multiplies the work by 58. Matching three characters at each end is roughly a six-character search, about 38 billion attempts on average; four at each end is an eight-character search, about 128 trillion.

Those numbers explain the defense. Bitquery found most look-alikes matched four or more characters at each end and the rest matched three, because that is what wallets display. Nobody can afford to match the whole address: every extra character you check multiplies the attacker's cost by 58. If you compare six characters in the middle as well as the ends, a look-alike would need about 58^14 attempts, far beyond any GPU farm. Attackers can lower their cost per look-alike by checking each generated key against many target addresses at once, but no shortcut gets them anywhere near a full match.

I mention this as defensive knowledge. The Solana Vanity Address Generator on SOLTidy is free and makes keys on your own device; running a three- or four-character search and watching the time estimate is the quickest way to feel why checking only the ends is not enough. The full arithmetic is in how long a Solana vanity address takes.

What do Phantom, Solflare and Backpack do about it?

Wallets reduce the risk but, as of November 2026, none I could verify fully solves it, so the habit of copying from the source still matters. What I could confirm from official pages:

• Phantom. Its scam guide says to "never copy and paste an address from your transaction history" and to verify addresses before sending. It automatically hides fungible tokens with a URL in their name and uses Blowfish-powered transaction previews to flag malicious transactions. It has an address book under Settings. In February 2026, ZachXBT publicly criticized Phantom for not filtering spam transactions out of its history view (Cointelegraph); I found no announcement of a similar-address warning since.
• Solflare. Its help article on airdropped tokens tells users not to click links attached to unsolicited tokens. I found no official documentation of a look-alike address warning.
• Backpack. Backpack screens transactions with Blockaid (Cointelegraph, 2024). I found no official documentation of a poisoning-specific filter.
• Explorers. Solscan offers hide-spam and hide-low-value filters on activity tables and an address highlight setting that marks every occurrence of the same address on a page, which makes a look-alike stand out (Solscan guide).

Other ecosystems have gone further: MetaMask and Trust Wallet show a warning when a destination resembles an address you used before. If your Solana wallet adds this, use it, but do not rely on it.

How do you verify a Solana address before sending?

Verify an address by taking it from the original source every time and comparing more than its ends. This is the routine I use:

1. Copy from the source, never from history. Open the exchange's deposit page, the invoice or the recipient's message and copy the address there, every time.
2. Use your wallet's address book for repeat recipients. Save the address once, after verifying it, and pick the contact by name from then on.
3. Compare the whole address, or at least the ends plus a stretch in the middle. Read the first six, a block in the middle and the last six against the source. A look-alike matches the ends; it essentially never matches the middle.
4. Do a test transfer correctly. Send a small amount to the address copied from the source, confirm it arrived, then send the rest to that same address from the same source. In Bitquery's Gate.io case on November 17, 2025, the victim's first $10 test went to the right address; they then copied the look-alike from history, sent a second $10 test to it, and followed with 30,749.80 USDT. A test only proves that the address you used can receive funds.
5. Confirm the token mint, not the name. When sending or receiving stablecoins, check that the mint is the real USDC or USDT mint. The free Solana Rug Check labels recognized issuers such as Circle's USDC, so a fake "USDC" shows up as an unknown token with an active mint authority.
6. Be extra careful in the minutes after a payment. Dust arrives within seconds. If you see a new incoming transfer from a near-identical address, that address is now on your blocklist.

For the wider set of wallet habits, such as hardware wallets, separate hot and vault wallets and reading simulations, see the Solana wallet security checklist.

What should you do with the dust and the spam tokens?

Leave the SOL dust alone and close the spam token accounts if you want them gone. Neither can harm you while it sits there. What harms you is sending to the look-alike, or opening a link in a spam token's name and signing what that site asks.

• SOL dust. There is nothing to clean: tiny SOL just adds to your balance and opens no account. Do not send it back; that only puts the look-alike in your history as a recipient. Hide the entry if your wallet allows it.
• Real USDC or USDT dust from a look-alike. The tokens land in your existing token account and are real. Keep them; they are just a few cents.
• Fake tokens and other spam tokens. These sit in their own token accounts, each holding rent the spammer paid. Hiding them in your wallet changes only the display. Burning the balance and closing the account removes them from the chain and returns the rent, 0.00148844 or 0.00203928 SOL for a standard SPL account depending on when it was opened, to you.

Closing a token account is a call to the token program's CloseAccount instruction, which deletes an account you own and sends its rent to an address you choose. It does not visit the token's website, and a spam token's transfer hook is not invoked by a burn or a close. The only real risk in closing is burning a token you meant to keep, which is why closing is safe in general as long as you check what you selected. If you have already signed something on a scam site, closing accounts does not help; go to what to do if your Solana wallet was drained.

How does SOLTidy handle spam token accounts?

SOLTidy treats a spam token like any other account with a balance: it never selects it for you, and burning is a separate, explicit choice. I built it that way on purpose, and this is what the code does today:

• The Token Account Closer pre-selects only empty accounts. An account that still holds tokens is listed under "With balance" and tagged "Burn + close" in red; if you tick it, the transaction runs BurnChecked for the whole balance and then CloseAccount, and the panel warns how many accounts will be burned first. Frozen accounts, and accounts with a close authority other than you, are not listed, because the token program would reject them.
• The home wallet cleanup quotes each leftover token against SOL through Jupiter. A spam token with no route, or one worth less than a network fee, is offered for burn and close instead, unselected until you choose it and confirm.
• Token logos come only from a CDN-proxied image in the RPC's asset data, never from the raw off-chain URL in a token's metadata, which spammers use to fingerprint visitors. The closer lists tokens by mint address, not by their claimed name.
• Cost. Burn-and-close through the closer costs 5% of the rent recovered, about 0.00007 SOL on a 0.00148844 SOL account, plus the network fee. The separate Burn Tokens tool charges a flat 0.005 SOL per burn and is meant for burning part of a supply you hold; for spam, the closer is the cheaper route.

A free method is just as good for a single spam token. Phantom, Solflare and Backpack can burn a token from its detail screen, and spl-token burn followed by spl-token close does the same from the command line. A bulk tool only earns its keep when there are many accounts.

Bottom line

Address poisoning on Solana costs attackers a fraction of a cent per attempt, reached about 4.5 million wallets in 11 months to October 2026, and took at least $940,106 from the 1,104 people who paid a look-alike. It works only if you copy an address from your history, so copy from the source, use the address book, check characters in the middle as well as the ends, and treat any near-identical sender that appears seconds after a payment as hostile. The dust itself is harmless: leave tiny SOL where it is, ignore the links in spam tokens, and when you want the spam accounts gone, burn and close them with the Token Account Closer to take back the rent the spammer paid.