A monthly report from Verdix's poisoning watcher, which reads every token transfer on Base as blocks arrive. Data from Sep 23 (when the watcher started) through Oct 19, 2026, end of day UTC; the month isn't over yet, so October figures are month to date.
1,078,205
new lookalikes, 1–19 October (month to date)
56,748 per day on average
1,820,544
flagged in total
since Sep 23, 2026
7,545,783
poisoning transfers seen
on flagged lookalikes, all time
926
fake token contracts flagged
770 of them new in October
3 · $2,080
real payments to lookalikes we had already flagged
since the watcher started
New lookalikes per day
Fake-token baitZero-value bait
UTC days, each address counted once, on the day we first flagged it. The dashed line marks October 1. In October so far the busiest day was Oct 05 (91,727) and the quietest Oct 15 (22,680).
Table: every day
Day (UTC)
New lookalikes
Fake-token bait
Zero-value bait
2026-09-23
1,976
0
1,976
2026-09-24
59,605
16,327
43,278
2026-09-25
127,902
119,243
8,659
2026-09-26
63,325
53,798
9,527
2026-09-27
145,119
121,741
23,378
2026-09-28
63,458
32,436
31,022
2026-09-29
172,506
149,772
22,734
2026-09-30
108,448
91,839
16,609
2026-10-01
72,404
28,929
43,475
2026-10-02
42,552
27,575
14,977
2026-10-03
39,050
24,019
15,031
2026-10-04
37,657
26,572
11,085
2026-10-05
91,727
64,855
26,872
2026-10-06
60,480
35,361
25,119
2026-10-07
57,922
39,515
18,407
2026-10-08
62,524
61,531
993
2026-10-09
78,422
30,147
48,275
2026-10-10
75,519
47,205
28,314
2026-10-11
62,041
53,448
8,593
2026-10-12
55,917
55,141
776
2026-10-13
44,363
43,630
733
2026-10-14
34,605
33,412
1,193
2026-10-15
22,680
21,883
797
2026-10-16
71,167
70,665
502
2026-10-17
56,896
55,730
1,166
2026-10-18
43,054
41,217
1,837
2026-10-19
69,225
68,677
548
By week
Week (Mon–Sun)
New lookalikes
Per day
Fake-token
Zero-value
Sep 23–Sep 27 (partial)
397,927
79,585
311,109
86,818
Sep 28–Oct 04
536,075
76,582
381,142
154,933
Oct 05–Oct 11
488,635
69,805
332,062
156,573
Oct 12–Oct 18
328,682
46,955
321,678
7,004
Oct 19–Oct 19 (partial)
69,225
69,225
68,677
548
What the bait looks like
A poisoner needs the lookalike address to show up in your wallet history, next to the real one. On Base we see two ways of doing it:
Fake-token transfers (77% of new lookalikes in October). The attacker deploys a worthless token whose name looks like USDC, USDT or WETH (often with look-alike letters from other alphabets or invisible characters) and records a "transfer" of the same amount you really sent, to or from the lookalike. We flagged 926 such token contracts so far.
Zero-value transfers (23%). A transfer of exactly 0 real USDC or USDT between you and the lookalike. Anyone can create one for any wallet; no permission is needed.
A third kind, dust (a tiny real amount sent from the lookalike), is also used, but we don't flag on it alone, so it isn't counted here. One bot transaction often carries several kinds at once; each address is counted under the kind we saw first. Since mid-October almost all new lookalikes come with fake-token bait; zero-value bait is still sent, but mostly to lookalikes that are already flagged.
Why the first and last four characters aren't enough
Wallets usually shorten an address to its start and end, like 0x1a2b…9f0e. Poisoners generate a fresh address that matches exactly those characters: the first 4 and last 4 hex characters after 0x, 8 characters in all. That is about 4.3 billion possibilities, which ordinary GPU software works through quickly. The middle 32 characters are different, and that's the part people don't read.
Our watcher keeps, for every wallet, the counterparties it really exchanged $1 or more of USDC or USDT with in the last 7 days. When a bait transfer links that wallet to an address that matches one of those counterparties 4+4 but isn't it, the address is flagged, in the same block.
Real money, already flagged
Since the watcher started, we found 3 payments of real stablecoins, $2,080 in total, sent to lookalike addresses that were already in our feed, between 32 hours and 6.5 days before the money moved. A wallet or exchange that checked the recipient against the feed could have warned the sender before they signed.
Paid (UTC)
Amount
Flagged before the payment
Checked on-chain by hand
Oct 02
$101.90
32 hours
yes
Oct 09
$20.15
4.5 days
yes
Oct 16
$1,958.20
6.5 days
yes
Amounts are what was sent. Sender and lookalike addresses are left out on purpose.
The largest case: on October 9 a Base user paid a regular counterparty. Within minutes a bot planted fake copies of that payment in the user's history, sent to addresses sharing the counterparty's first and last four characters, and refreshed them every day. We flagged the lookalike 29 minutes after the real payment. On October 16 the user copied the wrong address from their history and sent it 1,958 USDC: 6.5 days after our flag. In another case a lookalike we had flagged because it was aimed at one person was paid by a different person who used the same real counterparty.
No wallet used our data at the time, so these are losses that could have been prevented, not ones that were. Three cases are examples, not a statistic.
How to protect yourself
Never copy an address from your transaction history. Take it from the recipient directly, or from your wallet's saved address book.
Compare the whole address, not just the first and last few characters. Poisoners match those on purpose.
After a test payment, don't re-copy the address. Poisoners strike between the test and the real payment, often within minutes. Reuse the address you already verified.
For businesses: real-time feed / API of flagged lookalike addresses, for wallets, exchanges and payout teams → lauras@verdixapi.com
Method and limits
Base only, and only since September 23, 2026, when our watcher started. The first day is partial.
All numbers are lower bounds. We only flag 4+4 lookalikes of counterparties that really exchanged $1+ USDC/USDT with the target in the previous 7 days. Lookalikes of other tokens, of native ETH payments, or matching a different number of characters aren't counted, and neither are fake tokens whose names we don't yet recognise.
Precision: in a random sample of 50 flagged lookalikes, each re-checked on-chain independently of our index, all 50 were confirmed poisoning: at least 93% at 95% confidence. Addresses we have corrected by hand are left out of every number here.
Payments: only real USDC, USDT, USDbC or DAI of about $1 or more, sent to a lookalike strictly after we flagged it by someone we hadn't flagged. Native ETH isn't seen. Every payment listed was checked on-chain by hand. Payments to lookalikes we never flagged are not counted, so this is not the total stolen on Base.
Counts come only from our own reading of the chain; no explorer labels or third-party lists are used. Live numbers, updated hourly: /stats.