Fake Tokens, Copycat Tickers and Address Poisoning

A token's name and ticker are just text the creator types in. There's nothing stopping anyone from launching ten tokens called the same thing as today's hottest memecoin — and scammers do exactly that, every day. The only thing that identifies a token is its contract address (on Solana, the mint address).

//Copycat tokens

When a token goes viral, copies appear within minutes on the same chain and on others. They use the same name, ticker and logo, sometimes even the same website text. Buyers searching by ticker on a DEX or in a trading bot pick the wrong one, and the copycat's creator dumps on them.

Signs you're looking at a copycat:

• It's much younger than the token everyone is talking about.
• Liquidity and holders are a fraction of the original's.
• The socials link to the real project's accounts — but the real project's accounts never mention this address.
• It's on a different chain from the original.

Lookalike tickers

Some fakes go further, using Unicode lookalike characters or invisible zero-width spaces so a ticker displays as "USDT" or a famous memecoin name while being a completely different string. On-chain researchers at Bitquery documented a fake Tether-style token that reached over a million addresses in under two months using exactly this trick.

//Address poisoning

Address poisoning targets your transaction history rather than your buying. An attacker generates an address whose first and last characters match one you've recently used, then sends you a tiny or zero-value transfer from it. The next time you copy an address from your history, you copy theirs.

It's more common than most people think. A USENIX Security 2025 study counted around 270 million poisoning attempts against about 17 million victims, with at least $83.8 million in confirmed losses. In December 2025, one trader lost roughly $50 million in USDT after copying a poisoned address — after first sending a test transaction to the correct one.

//How to protect yourself

1. 01Get contract addresses from the source. Use the address published on the project's official X or website — and check that the official account actually links to it.
2. 02Compare the full address, not just the first and last four characters.
3. 03Never copy addresses from your transaction history. Use an address book or saved contacts.
4. 04Hide or ignore spam tokens in your wallet. Don't try to sell or interact with tokens you didn't buy — some are bait for drainer sites. See wallet drainers and approvals.
5. 05Search by contract, not ticker. Paste the contract address into TrenchScore's search to land on exactly the right token.

//How TrenchScore helps you pick the right token

When you type a ticker into TrenchScore's search, you get every match across chains with its chain, contract address, liquidity, market cap and age side by side, so a two-hour-old copy with $3K of liquidity stands out next to the real token. Paste a contract address and you go straight to that exact token. Tokens already in the Trench 100 carry their rank badge in results.