SignLens

Warnings › Lookalike addresses

Address poisoning: an address that only looks like the right one

Published

People check an address by its first and last few characters. Address poisoning exploits that: a scammer sends you a tiny transfer from an address that starts and ends like one you use, so that the next time you copy a recipient from your history, you copy theirs.

It works at scale. Bitquery counted 4,497,798 Solana wallets targeted between 30 October 2025 and 7 October 2026; among the wallets poisoned up to July 2026, at least 1,104 paid a lookalike, at least $940,106 in all. In December 2024 Scam Sniffer reported two victims losing 272 SOL this way.

What SignLens shows

SignLens holds your own addresses and an address book you keep in its settings. It compares every address a transaction pays, delegates to, hands authority to or closes an account into with those, four characters at each end, and a lookalike is a high finding. A constructed example, with "Bob" in the address book:

Warning

Send 0.1 SOL to 6Q6w…ni4j

What SignLens found

What this does

Full text, as the engine prints it
Send 0.1 SOL to 6Q6w…ni4j
WARNING: review the findings before approving

Findings:
  [HIGH] The recipient 6Q6w5TbVR788jYjwqn6bNncWZLCoogXgP5VTQiaPni4j looks like Bob (6Q6w…ni4j) but is a different address: only its first and last characters match

== Transfer | System program
  Amount: 0.1 SOL
  From: Your wallet (BqHR…Tx9A)
  To: 6Q6w5TbVR788jYjwqn6bNncWZLCoogXgP5VTQiaPni4j

== Signers
  Fee payer: Your wallet (BqHR…Tx9A)

== Fee
  Total: 0.000005 SOL
  Base: 0.000005 SOL

== Validity
  Expires: in about a minute (recent blockhash)

Effects:
  - You send 0.1 SOL from Your wallet (BqHR…Tx9A) to 6Q6w5TbVR788jYjwqn6bNncWZLCoogXgP5VTQiaPni4j
  - You pay a fee of 0.000005 SOL
  - Valid for about a minute (recent blockhash)

Raw: solana legacy (150 bytes)
  digest: e156c38f1c1e3a4e65155ab6927dc8775f06295d13bcf0f20e2190d4b1498d68
A constructed transaction, built to show this case; it was never sent. Explained for BqHR…Tx9A as the signer, by the SignLens engine 0.3.0, on 2026-11-01. How to read this.

An address in your book is named in the window; a recipient nobody has named says so.

What to do

Keep the addresses you pay in SignLens's address book, and never copy a recipient from your transaction history.

Other warnings: accounts given away, spending rights, signatures that never expire, programs it does not know, multisig approvals you cannot see, a swap paying someone else.

Try it: install SignLens for Chrome or Firefox.

Sources