Fake Addresses Dusted 4.5 Million Solana Wallets in 11 Months

Bitquery counted 4,497,798 Solana wallets touched by lookalike payment addresses over 11 months, from 30 October 2025 to 7 October 2026. Almost none of them lost money that day. The fake address just needed to be there, in the wallet's history, when someone next hit paste.

The full study is on Bitquery's investigation page, and its numbers are a useful guide to how the trick is built.

How the Dust Trick Works

A Solana address runs to dozens of characters, and most people check the front and the back. The scammers count on that. Their fake address opens with the same few characters as the one you actually pay, and ends the same way.

Bitquery's rule for calling a wallet poisoned was strict. There had to be a same-day payment of at least $1 in SOL, USDC or USDT, followed by dust or a fake stablecoin from an address matching at least three characters at each end of the payee. Under that rule, 9.4 million fake addresses reached 4,497,798 wallets.

Speed is the whole design. On the median day the dust arrived 18 seconds after the real payment, and three in four dust transfers landed within a minute. That puts the fake right next to the genuine payment in your recent list, ready to be copied the next time you send to the same exchange or the same person.

Most of the lookalikes matched four or more characters at each end. The rest matched three. About 42,000 wallets were dusted on the median day, and roughly 305,000 got dust on ten days or more.

Why a Test Payment Doesn't Save You

The clearest case in the study ran through Gate.io. On 17 November 2025 a wallet sent $10 in USDT to its deposit address at the exchange. Twelve seconds later, dust arrived. Two minutes after that, the wallet sent a second $10 test, this time to the fake.

The test landed. That confirmed the address could receive, and nothing else.

A minute and a quarter later, the wallet sent the rest: 30,749.80 USDT.

A test payment does not help if the test goes to the fake too.

The second case is larger. On 3 December 2025 a wallet paid SOL to its Crypto.com deposit address, took dust back, and less than an hour later sent $166,330 in SOL to the lookalike. That fake matched the real deposit address on its first four and last four characters: HJ7f at the start, rYEz at the end.

The trap is set quickly and sprung slowly. Only one payment in ten to a lookalike came within an hour of the first dust, and a quarter within a day. The rest came later, once the fake had settled into the payment history as a familiar entry.

Most Losses Are Small, a Few Carry the Total

Bitquery puts Solana's counted loss at $940,106, and calls that figure a floor. Of the roughly 3.0 million wallets poisoned before mid-July 2026, 1,104 later sent at least a dollar to a fake. That is about 1 in 2,750.

The typical loss is small: the median payment to a fake was $50, and 64% were under $100. The tail is what moves the total. Twelve payments of $10,000 or more carried 62% of the money, and the December payment alone carried 18%.

The floor has a defined edge. Bitquery counted payments of at least $1 to a lookalike within 90 days of its first dust, or on a later day when more dust arrived, for wallets poisoned up to 9 July 2026. It also stripped out 90 cases worth $343,799 that looked like people paying their own wallets or business partners. Wallets poisoned after that July date are not in the total at all.

Who the Fakes Pretend to Be

Copies of exchange deposit addresses did the most damage, taking 40% of the stolen dollars, most of them at Binance and Bybit. Another 17% went to copies of deposit addresses at gambling sites, led by Stake. Those labels show which addresses were imitated, not who is behind the fakes.

On the way out, the money moves fast and narrow. The top 20 lookalikes collected 68% of all stolen dollars, and 19 of the 20 passed the whole amount along in single file through fresh wallets. Ten hops took less than a minute in most cases, and no wallet on any path had more than five senders.

The funding side is mostly disposable. One address, labelled QVtW…KNQ4, started sending in late March and has sent SOL to 5.1 million addresses since. The rest are one-offs: 98% of funders paid for one or two fakes and were never seen again on the study's sample days.

Then it stopped. In the ten days before 3 July 2026, about 52,000 wallets a day got dust. Over the next eight days, no day reached 10,000, and the largest funder went quiet in the same month.

Solana Versus Ethereum

The same scam runs on Ethereum at a bigger scale in both directions. Bitquery found 8.0 million wallets targeted over 12 months there, with 1,635 people paying a lookalike and losing $76.1 million between them.

Solana's victims fall for it about 1.8 times as often, 1 in 2,750 against Ethereum's 1 in 4,891, but they lose much smaller sums. The median theft on Solana was $50, against $300 on Ethereum, which goes a long way to explaining why the two totals look so different.

What to Check Before You Send

Dust cannot take anything out of a wallet on its own. The loss only happens when someone copies the address the dust came from.

That makes the fix simple, if not easy. Copy the address from its source every time: the deposit page of the exchange, or the message from the person you are paying. Never copy one from your list of recent payments. Phantom's own address-poisoning guidance says much the same, and adds the part that hurts: tokens sent to the wrong address cannot be recovered.

The 4.5 million figure measures how many wallets were reached, not how many were robbed. The expensive step is the paste, and it is the only part a holder controls.