A Solana wallet tested a fake address with $10, then sent it $30,750

The world of cryptocurrency has revolutionized the way we think about finance, providing a decentralized, secure method for transactions. However, this innovation has also attracted a host of malicious actors and scams that can exploit unsuspecting users. One such scam, recently unveiled by blockchain data firm Bitquery, has shed light on how even a small test transaction can lead to significant financial loss.

The Mechanics of Address Poisoning

According to Bitquery's findings, an alarming 4,497,798 Solana wallets were targeted over an 11-month period. This figure does not represent confirmed losses but rather the sheer scale of the targeting efforts. The technique at the center of this scam is known as address poisoning, a method designed to confuse users by planting misleading entries in their transaction histories.

In technical terms, address poisoning occurs when a scammer sends a small amount of cryptocurrency, often referred to as "dust," to a legitimate wallet. This tiny transaction appears alongside the wallet's genuine transaction records, creating a lookalike address. If the wallet owner later copies that address, believing it to be valid, they inadvertently send funds to the scammer's address.

A Case Study: The $10 Test Transfer

To illustrate this point, Bitquery analyzed a specific case from November 17, 2025, where a wallet owner initiated a $10 USDT test transfer to what they believed was their Gate.io deposit address. Just 12 seconds later, a lookalike address sent a tiny amount of dust to the same wallet. Following this, the user mistakenly sent an additional $30,749.80 USDT to this fraudulent address, resulting in a significant loss.

The implications here are clear: a successful test transaction can create a false sense of security, leading users to believe they are sending funds to a trusted address. However, the scammer controlling the lookalike address can siphon off large amounts of money, capitalizing on this confusion.

The Scale of the Scam

Bitquery's research not only highlighted the mechanics of individual cases but also quantified the broader implications of this address poisoning tactic. Between October 30, 2025, and October 7, 2026, the firm found that 1,104 wallets had made qualifying payments that totaled $940,106 in losses. The study required these transactions to follow a specific pattern: a payment of at least $1 in SOL, USDC, or USDT, followed by the receipt of dust or a fake stablecoin token from an address that closely matched the intended payee.

While the overall targeting metric of 4.5 million wallets paints a grim picture, it is important to note that not all wallets targeted experienced financial loss. The study focuses on a smaller subset that followed the established criteria and excluded wallets that already had prior relationships or transactions.

Real-World Implications: The Need for Vigilance

The findings from Bitquery underscore the growing complexity of cryptocurrency scams and the importance of user vigilance. The traditional financial ecosystem is already rife with scams, but the decentralized nature of cryptocurrencies presents unique challenges. Address poisoning is just one method among many that scammers employ, but it demonstrates how easily users can fall victim to such tactics.

Phantom's Guidance: In light of these findings, wallet providers like Phantom have issued guidelines to help users protect themselves. Their advice includes:

• Avoid copying addresses from transaction histories.
• Verify the address before sending any funds.
• Check transaction statuses on block explorers to confirm legitimacy.

A Broader Perspective: The Crypto Landscape

As the cryptocurrency market matures, the rise of scams like address poisoning highlights the need for increased security measures and education among users. The decentralized nature of blockchain technology means that mistakes can be costly and irreversible. Unlike traditional banking systems, where transactions can often be reversed, once cryptocurrency is sent to the wrong address, it is typically lost forever.

The Ethereum Network, for instance, has also seen spikes in phishing scams, particularly during times of high activity when gas fees are low. This creates a fertile ground for scammers to operate, exemplifying the need for heightened awareness in the crypto community.

Conclusion: Staying Safe in a Digital Age

As this case illustrates, the line between security and vulnerability in the cryptocurrency space is incredibly thin. While the allure of decentralized finance continues to attract users, the associated risks cannot be ignored.

To safeguard against scams like address poisoning, users must adopt a proactive approach to their digital finances. This includes:

• Double-checking addresses before sending funds.
• Utilizing secure wallet options that come with built-in safety features.
• Staying informed about the latest scams and security practices.

In a rapidly evolving digital landscape, knowledge is power. Users must make it a priority to educate themselves about the risks and best practices in cryptocurrency to protect their assets and navigate this brave new world safely. The recent findings from Bitquery serve as a stark reminder: in the world of crypto, caution is paramount.