A crypto trader lost $50 million in about ten seconds last December. Not to a hack. Not to a stolen password. They sent money to an address that looked right, until the last few characters. A scammer had planted that lookalike address in their history days earlier. This trick is called address poisoning. It has quietly drained hundreds of millions from everyday users and billion-dollar exchanges alike. A research group called AmericanFortress just built a piece of math that could make it nearly impossible: a zero-knowledge wallet proof.
How a Zero-Knowledge Wallet Proof Actually Works
Most crypto wallets use hierarchical deterministic design. One seed phrase generates hundreds of addresses underneath it. That is great for privacy, but it creates a problem. How do you prove two addresses on two different blockchains belong to the same person? Until now, you could not, not without exposing your seed phrase or your entire history.
AmericanFortress solved it with a research paper called Provenance Proofs. Researchers Vincenzo Botta, Michal Pospieszalski, Emanuele Ragnoli, and Justus Ranvier built a system that proves a Bitcoin address and a Solana address share the same hidden seed. It never reveals that seed. Users even choose how much to show: a quiet one-time proof, or a persistent tag that lets exchanges recognize a trusted depositor automatically. The math leans on hash functions instead of elliptic curves, which also makes it more resistant to future quantum computers. That is a goal Bitcoin’s own post-quantum push is racing toward separately. In testing, the system proved a full cross-chain link in about 13 seconds and verified it in under one.
“An attacker now has to commit an equal amount of their own capital and initiate a legitimate transaction” before they can even attempt theft, according to AmericanFortress CEO Michal Pospieszalski.
That one sentence is the whole point. This does not just detect scams after the fact. It makes a scam cost the attacker as much as the victim.
What This Means for Your Money and Your Time
Picture Diane, a retired schoolteacher in Arizona who bridges a little USDC between Ethereum and Solana each month to pay a contractor finishing her kitchen. Right now, she sends a $1 test payment first and waits ten minutes before trusting the rest. That ritual costs her time, and it still would not catch a poisoned address planted weeks earlier. A wallet built on this proof checks the connection in under a second, before she ever hits send.
The stakes are not small. Here is what address-related theft has already cost:
| Incident | Amount Lost | How It Happened |
|---|---|---|
| Bybit exchange, Feb 2025 | $1.5 billion | Address swapped during a bridge transaction |
| Individual trader, Dec 2025 | $50 million | Poisoned address in transaction history |
| Individual trader, Jan 2026 | $12.25 million | Poisoned address in transaction history |
| Industry-wide, Jan 2026 | $370 million | Phishing and address-based scams, combined |
Even modest adoption could claw back a real slice of that $370 million a month. For a small business owner paying overseas suppliers in stablecoins, or a parent sending a crypto gift to a kid away at college, it means skipping the nervous habit of re-reading a 42-character address five times before hitting confirm. That is genuine peace of mind, and minutes back every time money moves.
The Catch: This Isn’t in Your Wallet Yet
AmericanFortress has a working benchmark, not a shipped product. No wallet app and no bridge uses this today. TheNextWeb’s coverage flags the same gap: strong cryptography on paper still needs real integration before it protects anyone. The same was true of Chainlink’s CCIP 2.0 upgrade earlier this year. The idea was never the hard part. Getting wallets and bridges to actually turn it on always is.
Watch for which wallet provider announces support first, and whether a major exchange builds it into address checks by default. Until one does, keep sending that small test transaction before a big one. The scammers are counting on you not to.