ZachXBT Criticizes Phantom For Address Poisoning

Steady attention without excessive speculation.

The warning

ZachXBT shared a recent case where a user lost 3.5 Wrapped Bitcoin (WBTC), valued between $175,000 and $210,000. The user copied a spoofed address from their transaction history and sent funds to it. According to ZachXBT, Phantom’s user interface played a major role in enabling this mistake.

The scam, known as address poisoning, relies on attackers sending dust-level transactions from addresses that closely resemble real ones. These fake addresses often match the beginning and end of familiar wallet addresses, making them easy to confuse. Phantom’s UI currently displays only shortened address formats, which increases the risk of such errors.

ZachXBT posted a screenshot of a wallet showing multiple spam transactions from lookalike addresses. He pointed out that Phantom does not filter these transactions, making users vulnerable.

Why this issue matters

Address poisoning is not a new technique, but it remains effective because many users rely on copying addresses from recent transactions. Attackers act quickly by mimicking recently used addresses and sending tiny amounts of tokens. When users check their wallet history, they might copy the fake address instead of the correct one.

ZachXBT highlighted that this scam happens far more often than people assume. He included replies from users who admitted to falling victim. One user explained that they sent funds to the wrong address while rushing to leave for work. Another said they had been caught off guard during a similar moment of distraction.

Phantom has not responded

As of the morning of February 10, 2026, Phantom had not issued any public reply to ZachXBT’s criticism. A search across their official channels returned no relevant statements.

This silence stands out because Phantom has responded to security concerns in the past. In 2022, they launched an investigation after reports of a potential compromise. In 2025, they confirmed they were unaffected by a supply-chain issue and took steps to protect users. Following the FTX collapse, they also removed Serum DEX routes as a precaution. In this case, though, the team has remained quiet.

Ongoing pattern

This latest case is part of a growing trend. Several users have lost large sums of money due to address poisoning:

• In May 2024, a user lost $68 million in WBTC
• In December 2025, a trader lost $50 million in USDT after copying a poisoned test address
• In January 2026, a cross-chain exploit affected hundreds of wallets, resulting in losses of over $100,000

Many wallet providers have already added filters or warnings to help users avoid this kind of scam. Phantom has not done so yet, according to ZachXBT.

Community reactions

The post generated over 1,100 likes and many replies. Several users echoed ZachXBT’s concerns. Some wanted features that could block spam tokens. Others criticized Phantom for charging high fees while offering what they see as subpar protection. A few users pointed out problems beyond address poisoning, including issues with managing UTXOs and lost assets.

Some commenters questioned why users copy addresses from old transactions. In response, ZachXBT showed multiple real-world examples where people made this mistake in a rush. He argued that poor UI design makes it too easy to fall for these scams.

What this says about crypto security

The debate has raised larger concerns about wallet security and user experience. ZachXBT’s criticism focused on Phantom, but many agreed that the problem exists across the industry. Several replies called on wallet teams to prioritize safety over adding new features.

Right now, Phantom has not addressed the issue. Whether they take action or not, the incident shows that even experienced users can fall victim to simple scams. Improving UI design and adding basic protections may be just as important as rolling out new tools.