Bitquery counts 4.5 million poisoned Solana wallets
Bitquery counts 4,497,798 Solana wallets that received lookalike dust from 30 October 2025 to 7 October 2026. 1,104 later paid a fake address, $940,106 in all, a floor.
4.5 million wallets, few payments to the fake
Bitquery counts 4,497,798 Solana wallets that received dust from a lookalike address between 30 October 2025 and 7 October 2026. A lookalike copies the start and the end of the address that was just paid. The count is how many wallets were targeted. The losses are smaller.
Of about 3.0 million wallets poisoned up to 9 July 2026, 1,104 later sent at least $1 to the fake. Bitquery puts that sum at $940,106 and calls it a floor. That is about 1 in 2,750 of those wallets. Bitquery left out 90 cases worth $343,799. Under the study’s rules they look like payments to a wallet’s own addresses or to partners.
Note: This is reporting, not investment advice. It is not an offer to recover lost funds.
| Figure | Value |
|---|---|
| Wallets poisoned | 4,497,798 |
| Lookalike addresses | 9.4 million |
| Median day | about 42,000 wallets |
| Wallets that paid a lookalike | 1,104 |
| Sum of those payments | $940,106 |
| of which SOL | $600,510 |
| of which USDC | $269,418 |
| of which USDT | $70,178 |
A wallet counts on a day when it pays at least $1 in SOL, USDC, or USDT, and dust then arrives from another address. The lookalike shares at least three characters at the start and three at the end with the address just paid. Dust is SOL, USDC, or USDT worth less than one cent, or, in rare cases, a token that only carries that name. Losses are counted only for wallets poisoned up to 9 July, so each had three months in which to pay the fake. On the median day the dust arrived 18 seconds after the real payment. Four in five poisoned wallets received real SOL dust.
40% of the dollars sent to lookalikes went to copies of an exchange deposit address, using Bitquery’s address labels. The labels mark which address was copied. Bitquery does not treat that as a finding about the exchanges.
A 10 USDT test, then the rest
On 17 November 2025 a wallet sent 10 USDT to a Gate.io deposit address. Twelve seconds later, dust arrived from a lookalike. Two minutes after that, a second test of 10 USDT went to the fake. It arrived. Shortly afterwards the wallet sent 30,749.80 USDT.
Bitquery says Gate.io did not receive that payment. The address that did had only the start and the end of the deposit address in common. The median payment to a lookalike was $50. Twelve payments of at least $10,000 carried 62% of the money.
The full address, not the history
The practical point in the study is to check the full address, including characters in the middle. The ends are what the lookalike copies. An address is not taken from payment history. It comes from the deposit page, or from the message of the person who sent it.
Dust from an unknown address cannot move funds out by itself. The loss comes when that address is copied later. In Bitquery’s case a test payment did not help: the test to the fake arrived, and the large payment followed.
The pattern is described in Detecting address poisoning on Solana. The test transfer mentioned there as a habit does not stop the large payment once the test itself goes to the lookalike.
In the same window Bitquery counted sandwich attacks and failed swaps separately.
What to watch
- The loss total covers wallets poisoned up to 9 July 2026 and payments within 90 days
- 90 cases worth $343,799 stay out, because under Bitquery’s rules they look like a wallet’s own addresses or partners
Sources
- Bitquery — Address poisoning on Solana, on-chain figures verified 9 October 2026
- SOLANA·HUB — Detecting address poisoning · Sandwich attacks · Failed swaps