4.5 Million Solana Wallets Targeted, and a $10 Test Transfer Didn't Save One of Them

A test transfer proves nothing. That's the part nobody wants to hear.

The whole point of sending $10 before sending $30,000 is confidence. You check the address, you send a small amount, you watch it land, and then you send the rest. It feels responsible. It feels like due diligence. And on Solana, across 11 months and nearly 4.5 million targeted wallets, it failed over and over again.

The numbers don't lie

Blockchain-data firm Bitquery published findings on October 9, 2026, counting 4,497,798 Solana wallets targeted by lookalike payment addresses between October 30, 2025, and October 7, 2026. That's a full year of dust attacks, small incoming transfers that plant a fraudulent address right next to a legitimate one in your payment history.

The mechanism has a name, address poisoning, and it's brutally simple. You pay someone. A scammer sends you a token from an address that matches at least the first and last three characters of the address you just paid. Now your history shows two near-identical entries. Copy the wrong one later, and you're sending money to a stranger.

Here's the case that should end the argument about test transfers. On November 17, 2025, a wallet sent $10 in USDT to its Gate.io deposit address. Twelve seconds later, a lookalike sent dust. The wallet then sent a second $10 test, this time to the fake address, followed by 30,749.80 USDT to that same lookalike. The test succeeded. The money arrived. And it went to the wrong person.

What does a successful test actually prove? That the address exists and can receive funds. Nothing about who controls it.

The loss figure is a floor, not a headline

Now the number everyone will quote. Bitquery's loss analysis looked at roughly 3.0 million wallets poisoned through July 9, 2026. Of those, 1,104 made qualifying payments totaling $940,106.

That's the honest figure, and it's also an incomplete one. Bitquery says so itself. The count only includes payments of at least $1 within 90 days of the first dust. Payments after that window counted only if fresh dust arrived the same day. Wallets poisoned after July 9 were excluded entirely. Pairs with earlier payment history got stripped out to avoid false positives, which means some genuine thefts were swept away too.

So $940,106 is the floor. Not the ceiling.

The counterpoint deserves a hearing

Here's where the skeptics push back, and they've got a real argument. Four and a half million wallets is a big, scary number until you divide it. One thousand one hundred and four actual victims out of millions targeted is a hit rate of roughly 0.02%. In a universe where phishing, rug pulls, and private key theft move billions, a million dollars over nine months is a rounding error. Why should anyone outside Solana's security team care?

That's fair. And the answer is that the targeting count tells you how cheap this attack is. A dust transfer costs fractions of a cent. The scammer doesn't need to fool everyone. They need to fool one person with a large balance, and the November 17 case shows exactly how that happens.

Phantom's own guidance says the quiet part out loud. Don't copy addresses from your transaction history. Verify the address before sending. And understand that once tokens go to the wrong address, they can't be recovered. Two checks, not one. Confirm the exact recipient and network first, then look up the transaction on an explorer. The confirmation and the verification are different steps, and conflating them is how 30,749.80 USDT disappears.

But I'd push back on the skeptics a little harder than that. A 0.02% hit rate sounds small until you remember that this is industrial. It's automated, it's persistent, and it compounds. Eleven months of dust means millions of poisoned histories sitting in wallets right now, waiting for the next time someone copies an address in a hurry. The victims aren't careless. They're normal. That's the whole problem.

My verdict

The test transfer is security theater, and it needs to die. It's a ritual that gives the sender the feeling of caution without the substance of it. If you're copying an address from history, you've already lost the game. The check has to happen before the copy, not after the send.

But here's my real take, and it goes past Solana. This is an authentication failure, not a user-education failure. We built an entire industry on the promise that you don't have to trust anyone, that the math verifies everything. And then we hand people a 44-character string and tell them to eyeball it.

The FDA doesn't care about your chain. It cares about your audit trail. Same principle applies here. A system that can't tell you, with certainty, that the address you're paying is the address you meant to pay isn't a verification system at all. It's a suggestion.

The fix isn't more warnings. Wallets have been warning people for years, and the 0.02% keep clicking through. The fix is protocol-level. Human-readable names, allowlists baked into the wallet, address books that can't be poisoned by dust. Some of this exists. None of it's the default. That's the gap.

Patient consent doesn't belong in a centralized database, and neither does the trust in who you're paying. Both need to live where the transaction happens, not in a warning screen you've trained yourself to dismiss.

Nearly 4.5 million wallets got tagged. A thousand lost real money. But the number that should bother you isn't either of those. It's the one that walked away with 30,749.80 USDT because a test transfer told him everything was fine.