Address poisoning on Solana, and the moments a merchant is exposed.

How does an address poisoning attack work?

An address poisoning attack works by making the wrong address the most convenient one to copy. It runs in four steps:

1. The attacker watches public transfers on chain and picks a wallet that pays the same address repeatedly: a merchant sweeping to savings, a team paying a contractor.
2. They generate an address whose first and last few characters match that recipient. On Solana this needs no special tool: the standard key generator has a command for it.
3. They send your wallet a tiny amount, or a token named like a real one, from the lookalike. It now sits in your activity list, next to the real recipient.
4. Days later you open your history, copy what looks like the usual address, and send. The transfer is final; the attacker has your money.

The scale is known for other chains. A study by researchers at Carnegie Mellon University, presented at USENIX Security 2025 measured two years of Ethereum and BNB Smart Chain and reported: "6,633 incidents have caused at least 83.8M USD in losses, which makes blockchain address poisoning one of the largest cryptocurrency phishing schemes observed in the wild." The study did not cover Solana, and we know of no equivalent measurement for it; the mechanics carry over all the same.

What can an attacker put in a Solana wallet's history?

An attacker can put incoming transfers and unfamiliar tokens in a Solana wallet's history, but cannot fake a transfer out of it. Solana's documentation on transferring tokens is explicit: "The source account owner or an approved delegate signs the transfer." That closes one trick the USENIX study found on Ethereum, where a zero-value transfer could be recorded as if the victim had sent it. On Solana the poison arrives as one of two things:

• A tiny transfer. A small amount of SOL or USDC from the lookalike address. It looks like a customer or a counterparty paying you.
• A counterfeit token. Anyone can create a token and call it USDC. Phantom's help page on unfamiliar tokens puts it this way: "Blockchains are open networks, so anyone can send tokens or collectibles to your wallet without your permission." How to tell real USDC from a copy by its mint address is in checking for real USDC on Solana.

Neither one is a breach. The same Phantom page says: "Receiving an unfamiliar asset doesn't mean your wallet is compromised." The danger starts only when you send to the address that came with it.

How close can a lookalike Solana address get?

A lookalike Solana address can match as many leading and trailing characters as the attacker is willing to pay computing time for, and the characters most wallets show are exactly those. A Solana address is a 32-byte public key written out in base58 characters. The Solana command-line key generator includes a grind subcommand, described in Agave's source as "Grind for vanity keypairs", with options to match a prefix, a suffix or both. Each extra matched character makes the search about 58 times longer: the USENIX authors put the cost of matching d characters at 58 to the power d for base58 addresses, against 16 to the power d for hexadecimal Ethereum ones. So attackers match the parts a person checks.

Those parts are short. The USENIX paper recorded how wallets abbreviated addresses as of 2 January 2025 and found that Phantom showed the first four and last four characters. Fianto's own dashboard tables shorten addresses the same way, four characters, two dots, four characters. A lookalike that matches eight characters passes a glance at any of them.

Where does a Fianto merchant copy addresses, and from where?

A Fianto merchant copies an address by hand at only two moments, refunds and sweeps, because everything else is done by connecting a wallet and signing. You prove the receiving wallet by signing a message with it, and a wallet change works the same way with the new wallet, so no address is pasted in either step. That leaves:

The refund row matters most. A receiving wallet's history is public and busy, which makes it a good target: a lookalike of a real customer can send you dust right after their payment, and the two rows sit side by side. The dashboard's list tables show only the four-and-four short form; open the payment itself, where the full address is printed and the copy button copies all of it. The whole refund procedure is in refunding a USDC payment, and where the payment sits in the dashboard is in the docs on orders and payments.

Why does a hosted checkout remove address copying for payers?

A hosted checkout removes address copying for payers because the payer never handles the merchant's address at all. On a Fianto checkout the customer connects a wallet and approves one transaction that Fianto has already built with the merchant's proven receiving wallet in it; there is no field to paste into and nothing to type. Shop purchases and payment links open the same checkout.

Compare that with a bare wallet address on an invoice or a website, where every customer copies the address, and every customer whose history has been poisoned is one paste away from paying someone else. A hosted checkout vs a bare wallet address covers what else changes.

It does not protect against a fake checkout page. A scammer who sends you a link to a lookalike site is running a different attack, covered in wallet drainers and fake payment requests.

What do wallets do about address poisoning?

Wallets hide spam and warn on risky copies, but none of that replaces copying from the right source. Phantom, Solflare and Backpack compared for USDC payments covers the wallets themselves. Phantom's guide to common crypto scams gives the rule in one line: "Never copy and paste an address from your transaction history." It also describes a warning: "If you copy an address from your transaction history that you haven't sent funds to before, we warn you."

Read that warning closely. It fires for an address you have never paid. It cannot tell you that the address you meant is a different one. Hiding spam helps too: Phantom asks you to report an unfamiliar token as spam, which hides it, and not to follow links or instructions that come with it. Hiding it leaves its token account on chain; closing empty token accounts covers burning the balance and getting that account's rent back.

What should you do if you sent USDC to a poisoned address?

If you sent USDC to a poisoned address, treat it as gone: a confirmed Solana transfer cannot be reversed by you, by Fianto or by the wallet, the same finality covered in chargebacks vs crypto refunds. Fianto never holds funds, so it has nothing to claw back. Anyone who offers recovery for a fee is running the next scam, as crypto payment mistakes explains.

1. Stop using the poisoned row: report or hide the token, and delete the address if you saved it.
2. If it was a refund, send the customer the correct amount again from the payment page address, and record both transfers.
3. If it was a sweep, save the correct savings address as a contact now, from the savings wallet or the Squad's settings, and send a small test first.