How to Detect and Prevent Address Poisoning on Solana

Address poisoning is a copy-paste trap: an attacker plants a deceptively similar address in your transaction history and waits for you to copy it the next time you send. No hack, no malicious signature — the attack exploits a single habit that almost everyone has.

Short answer: In an address poisoning attack, an attacker generates a vanity address whose first and last characters match one of your real contact addresses, then sends you a zero-value or dust transaction so it appears in your history. If you later copy the address from your history, your funds go to the attacker. Protection: never copy addresses from your history, verify the full address before sending (not just the ends), maintain an address book, and send a test transaction for large amounts.

In plain terms: The attacker slips a forged business card into your stack of real ones. Anyone who only checks the first and last letters will eventually grab the wrong one.

What Is Address Poisoning? The Look-Alike Address Trick

Solana addresses are 32 to 44 characters long. Nobody reads them in full — wallets and explorers therefore truncate them in the UI to a pattern like 7xKQ…9fRw: first four characters, last four characters. That abbreviation is exactly what the attack targets.

The attacker watches public on-chain data, picks an address you send to regularly, and generates a keypair whose public address carries the same characters at the start and end. Such “vanity addresses” can be brute-forced with standard tooling like solana-keygen grind — matching four to five characters at one end takes seconds to minutes on ordinary hardware. The middle of the address is different, but you never see it in the truncated display.

To get the forged address into your wallet history, the attacker sends you a transaction: a transfer of 0 tokens, a few lamports of dust, or a worthless spam token. Your history now shows an entry with an address that looks like your real contact at first glance. The trap is set — and the attacker waits.

How an Address Poisoning Attack Plays Out on Solana

Explained on general patterns, the scheme typically runs in four steps:

1. Observe: The attacker scans public transactions for wallets with recurring transfers — such as regular deposits to an exchange address or to a second self-owned wallet.
2. Replicate: They generate a vanity address that imitates the first and last characters of the genuine destination.
3. Poison: From the replicated keypair, they send a zero-value or dust transaction to your wallet — often immediately after one of your genuine transfers, so the forged entry sits right next to the real one in your history.
4. Wait: On your next transfer, you copy the address from your history — “that was the last transaction to this contact” — and send to the attacker. The transaction is valid, correctly signed, and final.

The critical point: you authorize the transaction yourself. There is no malicious signature request as with a wallet drainer and no compromised key. The attack happens entirely in your perception.

Why Solana Is Especially Exposed

Three properties of the network make this pattern particularly cheap and scalable on Solana:

• Fees in the fraction-of-a-cent range: A base transaction costs 5,000 lamports — fractions of a cent. An attacker can poison tens of thousands of wallets at once, and a single successful copy-paste mistake makes the campaign profitable. On networks with high fees, the same spray would be orders of magnitude more expensive.
• Vanity addresses are standard tooling: solana-keygen grind is part of the official Solana CLI. Prefix and suffix matching across a few characters is computationally trivial — the same feature projects use to mint pretty addresses serves the replication here.
• Token transfers without the recipient’s consent: On Solana, any sender can create a token account (Associated Token Account) for your wallet and send you tokens — including zero-amount transfers or worthless spam tokens. You do not have to accept anything for the entry to appear in your history.

On top of that comes the display convention: almost every wallet and explorer truncates addresses to their start and end. The truncation is convenient — and exactly the attack surface.

Spotting Poisoned Entries in Your History — Step by Step with Solscan

You can audit your own history without connecting your wallet. Open your address in a block explorer such as Solscan or the Solana Explorer — the basics are covered in using Solscan. Then watch for these patterns:

1. Zero-value and dust transfers from strangers: Incoming transfers of 0 tokens or tiny amounts (a few lamports, 0.000001 of a token) from addresses you have never interacted with. This is the classic poisoning signal.
2. Timing right after your own transactions: Poisoning transfers often follow within minutes of a genuine transfer of yours — the forged entry is meant to sit next to the real one in your history.
3. Near-duplicates of known addresses: Compare suspicious senders against your real contact addresses. If the start and end match but the middle does not, the pattern is unambiguous. The explorer shows the full address — compare character by character, not just the ends.
4. Unknown token accounts: Spam tokens that appeared without your involvement often belong to poisoning or phishing campaigns. Do not interact with them — especially do not visit URLs embedded in token names.
5. Check the sender’s history: One click on the suspicious address reveals its behavior. Freshly created addresses that send hundreds of zero-value transfers to many different wallets within a short time are a typical campaign pattern. How to assess wallet behavior in general: check a wallet or token for scams.

Important context: a single dust transfer does not prove an attack attempt — harmless airdrops and tests exist too. The combination of zero amount, near-duplicate address, and timing next to your genuine transactions, however, is a clear warning picture.

Protective Measures: Habits That Make the Attack Fail

Address poisoning fails completely against a few habits:

• Never copy addresses from your transaction history. This is the one rule that breaks the attack. Always copy recipient addresses from a verified source: your wallet’s address book, the exchange’s official page, or directly from the recipient via a second channel.
• Verify the full address, not just the ends. Before confirming, compare at least eight to ten characters at several positions — including the middle. Attackers optimize exactly for the characters that truncated displays show.
• Use your wallet’s address book or whitelist. Verify frequent recipients carefully once and save them. From then on, you send to the saved contact instead of a freshly pasted string.
• Send a test transaction for large amounts. Send a tiny amount first, have the recipient confirm arrival via an independent channel, then send the rest. On Solana, the extra transfer costs practically nothing.
• Read the hardware wallet display. A hardware wallet shows the destination address on the device display before signing. That only protects you if you actually check it there against the verified source — the seed phrase is never the problem in this attack.
• Ignore spam tokens. Do not touch unknown tokens, do not “return” them, do not open embedded links. Many wallets can hide such entries.

These measures complement the baseline hygiene in Solana wallet security — address poisoning is its own vector alongside drainers and seed-phrase phishing and is not automatically covered by their defenses.

What to Do If You Already Sent to a Poisoned Address

The honest answer first: Solana transactions are final. There is no central party that reverses a confirmed transaction, and no legitimate “recovery” service that can do it for you — anyone promising that is very likely the next scam. What remains:

1. Document the incident: Save the transaction signature, timestamp, amount, and destination address from the explorer. This data is public and permanently verifiable.
2. Trace the funds: From the explorer, you can follow where the funds moved — for example, to an exchange deposit address. The method step by step: trace fund flow.
3. Report: If the funds land at an exchange with KYC requirements, notifying the exchange together with a police report can, in individual cases, lead to a freeze. That is not a guarantee — but it is the only realistic lever.
4. Clean up your own history: Block or hide the poisoned address in your wallet if it supports that, so the same mistake cannot happen again.

If you are unsure whether, beyond the copy-paste trap, your wallet itself was compromised, follow the checklist in wallet hacked — what to do.

Important Context

This article explains the method on general patterns — it does not label any specific, real address, person, or campaign as an attacker. Whether a single entry in your history is an attack attempt is something you verify yourself using the signals described, in a block explorer. Verify for yourself, judge for yourself.

Note: This is reporting, not investment advice.

Sources and Further Reading

• Official documentation and explorers: Solana documentation (addresses, keypairs, solana-keygen) · Solana Explorer · Solscan
• SOLANA·HUB knowledge: Detecting wallet drainers · Solana wallet security · Trace fund flow · Wallet hacked — what to do · Using Solscan · Check a wallet or token for scams
• SOLANA·HUB glossary: Wallet · Seed Phrase