Address poisoning is a scam where an attacker sends you a tiny or zero-value transaction from a wallet address that looks almost identical to one you use, hoping you will later copy that fake address from your history and send real funds to it.
Key takeaways
- The attacker never touches your wallet; they rely on you copying the wrong address.
- Fake addresses match the first and last characters of a real one, because most wallets shorten addresses.
- Never copy a recipient address from your transaction history.
- Use an address book, check the full address and send a small test first.
- A transaction you sent cannot be reversed, so prevention is the only protection.
The scam has grown with the use of stablecoins on cheap, fast networks, where sending thousands of spam transactions costs very little. It has caught out individuals and professionals alike, sometimes for very large amounts, because it exploits a habit almost everyone has: copying the address you used last time.
How address poisoning works
- You send funds to an address, for example your exchange deposit address. The transaction is public on the blockchain.
- A bot watches the network and generates a “vanity” address whose first and last characters match the one you used.
- The attacker sends you a transaction from that look-alike address. It may be zero tokens, a tiny amount, or a fake token with a real-looking name.
- The fake transaction now sits in your wallet history, right next to the genuine one.
- Next time, you open your history, copy what looks like the usual address, and send funds to the attacker.
Because wallets and explorers often display addresses shortened, such as 0x7a3f…9c21, the fake looks identical at a glance.
Warning signs in your wallet
| Sign | What it may mean |
|---|---|
| Incoming transfer of 0 tokens you did not expect | Classic poisoning transaction |
| Tiny “dust” amounts from unknown addresses | Poisoning or tracking attempt |
| Token with a familiar name but no value or odd contract | Fake token used as bait |
| An address that matches yours only at the start and end | Look-alike vanity address |
| Transfers appearing right after you made a payment | Bot reacting to your activity |
Seeing these does not mean your wallet is hacked. Your keys are safe; the danger is only in what you copy next.
Habits that stop the scam
- Never copy addresses from history. Get the address fresh from the source every time: the deposit page of your exchange, or the person you are paying.
- Use your wallet’s address book. Save trusted addresses once, after checking them carefully, and pick them by name.
- Check the whole address. Compare at least the first 6 and last 6 characters, and ideally a chunk in the middle too. Look for small differences.
- Send a test amount first for large or new transfers, confirm it arrived, then send the rest.
- Hide spam tokens. Many wallets can hide zero-value and unknown tokens so they do not clutter your history.
- Use the QR code or a hardware wallet screen to confirm the address on a second device.
For large balances a hardware wallet adds another check: you confirm the destination on the device itself before signing.
Related tricks to know
Address poisoning is part of a wider family of “copy-paste” attacks:
- Clipboard malware silently replaces an address you copied with the attacker’s. Keep your computer updated, avoid pirated software and double-check after pasting.
- Fake support messages tell you to “verify” your wallet at a link. Real support never asks for your seed phrase.
- Approval scams ask you to sign a token approval that lets a contract drain your funds. Read what you sign and revoke old approvals.
Our guide to crypto phishing explains these in more detail.
What to do if you already sent funds
Blockchain transactions are final. There is no bank to call and no chargeback. Act fast anyway:
- Stop using the poisoned history for any further payments.
- Record the transaction hash, the attacker’s address, amounts and times.
- If the funds were sent to a known exchange, contact that exchange with the details; they can sometimes freeze deposits.
- In Ireland, report fraud to An Garda Síochána. Keep copies of all evidence.
- Ignore anyone who contacts you promising to “recover” the funds for a fee. Recovery scams target victims of earlier scams.
Why the scam works so well
Address poisoning does not need any technical weakness in your wallet. It works because people are busy and because long hexadecimal strings are hard to read. A typical Ethereum address has 40 characters after the “0x”. Generating an address that matches the first four and last four characters of yours takes a normal computer only seconds, and matching more characters is possible with more computing power. Once that address appears in your history with the right token name and a familiar shape, the human brain fills in the rest.
Attackers also time their transactions carefully. Bots react within seconds of your payment, so the fake entry appears directly above or below the genuine one. Some even copy the exact amount you sent, or use a fake token whose name and logo copy a real stablecoin, so the line in your history looks perfectly normal.
A safe routine for regular payments
If you send crypto regularly, for example to your own exchange account or to a supplier, set up a routine once and follow it every time:
- Save the verified address in your wallet’s address book with a clear name.
- When paying, select the contact rather than pasting from anywhere.
- After pasting or selecting, compare the first six, middle six and last six characters with a trusted record.
- For any amount you could not afford to lose, send a small test transaction first.
- Confirm on the receiving side that the test arrived before sending the balance.
It adds a minute to each payment, which is a very cheap insurance against a mistake that cannot be undone.
Businesses and teams
Companies that pay suppliers or staff in crypto are a frequent target, because they send larger amounts and repeat payments often. Use a written approval process, keep a shared and protected list of verified addresses, require a second person to check the address for large payments and never accept a change of payment address by email or chat without confirming it through a separate channel.
FAQ
Can address poisoning steal from my wallet without my action?
No. It only works if you copy the fake address and send funds to it yourself.
Should I interact with the spam token to remove it?
No. Do not swap, approve or send the token. Simply hide it in your wallet.
Are some networks more affected?
The scam is most common where fees are low, because attackers can send many spam transactions cheaply, but it can happen on any public blockchain.
Does a hardware wallet prevent it?
It helps, because you check the address on a trusted screen, but only if you actually compare the full address before confirming.
Next step: review your seed phrase security and set up two-factor authentication on every exchange account. This article is general information, not financial advice.
