A built-in messaging feature in the Phantom crypto wallet is drawing scrutiny from security researchers after an investor lost about $264,000 worth of Wrapped Bitcoin in what investigators described as a phishing attack enabled by address poisoning.
Blockchain investigator ZachXBT <a href="https://x.com/zachxbt/status/2021022756460966139" rel="noopener noreferrer nofollow">shared</a> blockchain data pointing to a victim losing 3.5 Wrapped Bitcoin (wBTC) in a suspected phishing attack tied to Phantom Chat.
The data shows a transaction where 3.5 WBTC was transferred from address 0x85c to address 0x4b7 on Wednesday, flagged as a “high balance” address on blockchain intelligence platform <a href="https://app.nansen.ai/profiler?address=0x85cbe4af7167887839f27a759eed03e7af11d8f6&amp;chain=all&amp;name=0x85c...1d8f6&amp;tab=transactions" rel="noopener noreferrer nofollow">Nansen</a>. The transaction pattern is consistent with <a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam" rel="noopener noreferrer nofollow">address poisoning</a>, a phishing technique that exploits users’ transaction histories rather than compromising private keys.
Scammers trick victims into sending crypto to illicit wallets by first sending them small transactions and hoping unsuspecting users copy and paste the attacker’s address from their history.
ZachXBT urged Phantom to upgrade its user interface, calling the messenger feature a “new method for people to get drained,“ and warning that the app’s user interface did not filter out spam transactions to avoid users falling victim to address poisoning scams.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-02/019c479f-68c5-7bd9-8a90-08df3d48a5aa.png" title="" alt="Phantom Chat under scrutiny after $264K address poisoning loss">
 <figcaption>Wallet 0x85c, transactions. Source: Nansen
 </figcaption>
</figure>
X user Kill4h also <a href="https://x.com/cryptokill4h/status/2021099841145930043/photo/2" rel="noopener noreferrer nofollow">reported</a> falling victim to two address poisoning attacks through the messenger feature, sharing a screenshot of two blockchain transactions worth $136 and $101 in USDC (<a href="https://cointelegraph.com/usdc-price-index" rel="noopener noreferrer nofollow">USDC</a>), respectively.
Related: <a href="https://cointelegraph.com/news/fake-metamask-2fa-security-checks-lure-users-into-sharing-recovery-phrases" rel="noopener noreferrer nofollow">Fake MetaMask 2FA security checks lure users into sharing recovery phrases</a>
The incidents are the latest reminders of the importance of crypto wallet user experience for the safety of investors.
Leading crypto industry figures, including Binance co-founder Changpeng <a href="https://cointelegraph.com/news/zhao-fix-address-poisoning-investor-loses-50m" rel="noopener noreferrer nofollow">Zhao, have previously</a> called for better wallet security measures to avoid phishing scams, after an investor lost $50 million in an address poisoning scam in December 2025.
“All wallets should simply check if a receiving address is a ‘poison address,’ and block the user. This is a blockchain query,“ wrote Zhao in a blog <a href="https://www.binance.com/en/square/post/34142027296314" rel="noopener noreferrer nofollow">post</a> in December, adding:
<blockquote>
 “Lastly, wallets should not even display these spam transactions anywhere. If the value of the tx is small, just filter it out.“
</blockquote>
To avoid common crypto scams, Phantom <a href="https://phantom.com/learn/crypto-101/common-crypto-scams" rel="noopener noreferrer nofollow">recommends</a> that users assume any unsolicited tokens or NFTs sent to their wallets are part of a scam and urges users never to click on links in paid Google search results or social media platforms promising free airdrops.
Cointelegraph has reached out to Phantom for comment on the incident and details on future user interface upgrades.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-02/019c479f-6c5b-7ce4-b276-7e46d6ff3cfa.png" title="" alt="Phantom Chat under scrutiny after $264K address poisoning loss">
 <figcaption>Scammers are sending copycat tokens to unsuspecting investors. Source: Phantom
 </figcaption>
</figure>
Phantom <a href="https://x.com/phantom/status/2003246358745219393" rel="noopener noreferrer nofollow">announced</a> the launch of its live chat feature across tokens, perpetual futures and predictions pages on Dec. 23.
Related: <a href="https://cointelegraph.com/news/trm-labs-70m-investment-1b-crypto-unicorn" rel="noopener noreferrer nofollow">TRM Labs completes $70M investment round at $1B, becomes crypto unicorn</a>
<h2 id="crypto-investors-need-better-onchain-security-practices-cybersecurity-experts">Crypto investors need better onchain security practices: Cybersecurity experts</h2>
While spam filtering from crypto applications can reduce the risk of address poisoning attacks, users need to stop copying wallet addresses from their transaction history, urged security firm Hacken’s Extractor team.
<blockquote>“Web3 users have to maintain a single source of truth for recipient addresses (Address Book / List).“
</blockquote>
Hacken also pointed to a 12.3 million Ether (<a href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow">ETH</a>) address poisoning attack suffered by a wallet linked to Galaxy Digital on Jan. 30, serving as a reminder that even institutional participants can fall victim to these scams.
While improved transaction practices can help avoid such scams, the crypto industry needs pre-emptive security alerts to eradicate poisoning attacks,Deddy Lavid, the CEO of blockchain cybersecurity company Cyvers, told Cointelegraph:
<blockquote>
 “Real protection requires pre-transaction risk checks, address similarity detection, and clear warnings before users sign.“
</blockquote>
Users may also opt for wallets that provide real-time “firewall-style security simulation“ that shows how a transaction would occur before executed, the CEO said.
Wallets that offer preemptive tools to filter for malicious transactions ahead of approval include the Rabby Wallet, Zengo Wallet and Phantom Wallet.<iframe src="https://www.youtube.com/embed/t06mVWz6ngM?start=" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/meet-crypto-sleuths-fighting-crime-better-than-the-cops/" rel="noopener noreferrer nofollow">Meet the onchain crypto detectives fighting crime better than the cops</a>

Phantom Chat under scrutiny after $264K address poisoning loss

Table of Contents

Cointelegraph

Other articles published on Feb 10, 2026

Join our free newsletter for daily crypto updates!