Cryptocurrency address poisoning is a scam that plants a lookalike address in your transaction history, hoping you will later copy it by mistake and send funds to the attacker. It requires no malware, no stolen password, and no signature from the victim.
The attack exploits a habit rather than a software flaw: people often reuse an address from recent activity instead of retrieving it from a trusted source. This article explains how the trick works, who tends to be targeted, and the verification routines that make it ineffective.
What a Poisoned Wallet History Looks Like
Imagine you regularly send stablecoins to the same exchange deposit address. One day, a new entry appears in your history: a transfer of zero tokens, or a tiny amount, from an address that starts and ends with the same characters as that familiar deposit address.
You did not initiate it, and nothing appears to be wrong. Your balance is unchanged, and no approval was requested. Many users never notice the entry at all, because it blends into a list of routine transactions that look almost identical in a compact wallet view.
The danger arrives days or weeks later. When you next need that deposit address, you open your history, see a familiar-looking string near the top, and copy it. If you pick the planted entry, your payment goes to the attacker, and the blockchain treats it as a perfectly valid transfer.
Why Shortened Addresses Create the Opening
Blockchain addresses are long strings of letters and numbers. An Ethereum address, for example, is 40 hexadecimal characters after the “0x” prefix. Showing the full string in every list would be cluttered, so wallets and explorers usually truncate it to the first and last few characters.
That design choice is reasonable for readability, but it creates a weak point. People learn to recognize an address by its visible edges and stop reading the middle. An attacker who matches those edges can produce a string that passes a quick glance, even though most of the characters differ.
Address poisoning depends entirely on this gap between what is displayed and what is checked. The cryptography behind the address is untouched. The attack simply relies on humans comparing a handful of characters and assuming the rest match, especially when they are busy or copying under time pressure.
How Lookalike Addresses Are Produced
An address is derived from a public key, which in turn comes from a randomly generated private key. Because the output looks random, there is no direct way to choose an address. However, generating many key pairs and keeping those whose addresses match a desired pattern is computationally feasible.
The resulting string is often called a vanity address. Legitimate users sometimes create vanity addresses for branding, such as an address beginning with a memorable sequence. Attackers apply the same idea to imitate a victim’s counterparty, matching several leading and trailing characters.
Matching a few characters on each end is far easier than matching the whole address, which remains practically impossible. That is why careful verification works: the attacker can imitate the visible edges but cannot produce a full match. Checking more of the string, or using a trusted source, defeats the imitation entirely.
The Transfers That Plant the Fake Entry
Once an attacker has a lookalike address, the next step is getting it into the victim’s history. Several kinds of transactions accomplish this, and each relies on the fact that anyone can send assets to any address without permission.
Zero-Value Token Transfers
Some token contracts allow a transfer of zero tokens, and certain implementations let a third party trigger a zero-amount transfer that appears to come from the victim’s own address. The resulting entry can show the victim “sending” to the lookalike, making it look like an address they have used before. That apparent self-history is especially persuasive.
Dust Transfers
Dust refers to very small amounts of a cryptocurrency, too small to be worth much. An attacker sends a dust amount from the lookalike address so it shows up as a recent incoming transaction. The amount is irrelevant; the goal is to place the familiar-looking address where the victim is likely to copy it.
Counterfeit Token Transfers
Attackers can also deploy their own token contract using the name and symbol of a well-known stablecoin. Transfers of this counterfeit token appear in history with a trusted-looking label. A careful look at the token’s contract address reveals that it is not the genuine asset, but casual views may not show that detail.
The Moment the Mistake Happens
Address poisoning does nothing on its own. The loss occurs only when the victim chooses the wrong entry during a later payment. That makes the copy step the single most important point of defense, and it explains why the attack is so cheap to attempt at scale.
Common triggers include sending a large amount in a hurry, making a routine transfer from a phone with a small screen, or switching between wallets and copying from an explorer page. In each case the person is relying on recognition rather than verification, which is exactly what the attacker expects.
A useful mental model is to treat your transaction history as a public bulletin board that strangers can write on. It records what happened on-chain, including events you never authorized. It is not a curated address book, and nothing in it should be trusted as a payment destination without independent confirmation.
Who Attackers Tend to Target
Because blockchains are public, attackers can watch for addresses that make frequent, sizable transfers to the same counterparties. Those patterns suggest a victim who will reuse an address soon and whose payment would be worth stealing.
Typical targets include active traders moving funds between exchanges, businesses paying suppliers in stablecoins, organizations managing treasuries, and individuals who regularly fund the same wallet. Automated monitoring lets attackers respond within minutes of a legitimate transfer, planting the lookalike while the real interaction is still fresh in the victim’s history.
Small holders are not immune. Automated campaigns can target large numbers of addresses at once, since sending zero-value or dust transfers costs little on some networks. The key point is that being targeted says nothing about your security posture. It only means your address appeared active, and that is visible to everyone.
Red Flags in Your Transaction History
Recognizing poisoning attempts helps you stay alert even before you need to make a payment. These signs suggest that someone has seeded your history with a decoy.
- Transfers of zero tokens that you did not initiate, sometimes appearing to come from your own address.
- Tiny incoming amounts from addresses that resemble a counterparty you use often.
- Tokens with famous names but unfamiliar contract addresses.
- New entries appearing shortly after a large, legitimate transfer you made.
- Several near-identical addresses differing only in their middle characters.
Finding these entries does not mean your wallet is compromised, and you do not need to move your funds because of them. It does mean your history is no longer a safe place to copy addresses from, so switch to the verification habits described next.
A Reliable Address Verification Routine
Verification should be quick enough that you actually do it every time. The following routine fits into a normal payment workflow without much friction.
- Retrieve the destination from a trusted source, such as the recipient’s account page or a saved contact.
- Compare the full address, or at least long segments from the start, middle, and end.
- Confirm the network and token contract, not only the address.
- Send a small test transaction for large or first-time payments, and have the recipient confirm receipt.
- Recheck the address on your hardware wallet screen before final approval.
The test payment step deserves special attention. Note that an attacker who is watching may respond to your test by planting a new lookalike, so always copy the main payment address from the trusted source again rather than from the test transaction.
Address Books and Allowlists
Most wallets include an address book, a saved list of named destinations. Adding a verified address once, after confirming it carefully, lets you select it by name later instead of copying from history. That single change removes the main path the attack depends on.
Exchanges and custodial platforms often offer withdrawal allowlists, which restrict outgoing transfers to pre-approved addresses. New entries may require extra confirmation or a waiting period. For anyone sending funds repeatedly to the same places, an allowlist turns a careless click into a blocked request rather than a loss.
Keep these lists tidy. Label entries clearly, remove addresses you no longer use, and re-verify an entry if the counterparty tells you their address has changed. Confirm any such change through a separate channel, since attackers sometimes pair poisoning with messages claiming a new deposit address.
Wallet and Explorer Features That Help
Wallet interfaces have improved their defenses against poisoning. Some hide zero-value transfers, mark tokens that are not on a verified list, or warn when a destination closely resembles an address in your history. Enabling these filters reduces noise and makes decoys easier to spot.
Block explorers, which are websites that display blockchain data, may label suspicious tokens or flag transactions associated with known poisoning activity. These labels are useful signals but not guarantees. Labeling depends on detection and can lag behind new campaigns, so it should support your own checks rather than replace them.
Human-readable naming systems, which map a name to an address, can also help when the name is verified carefully. They introduce their own risks, including lookalike names, so treat them with the same care. Whatever tools you use, the final check should compare the destination against a trusted record.
Controls for Businesses and Treasuries
Organizations that send cryptocurrency regularly should treat address management as a formal process. A shared, access-controlled registry of approved counterparty addresses, maintained by more than one person, prevents individual staff from copying destinations out of a busy transaction log.
Multisignature wallets, which require several approvals before funds move, add a valuable review step. Each signer should independently verify the destination against the registry rather than trusting the person who proposed the transaction. Payment policies can require test transfers above a defined threshold and confirmation from the recipient through a known channel.
Training matters as much as tooling. Staff should understand that seeing a familiar address in history proves nothing about who controls it. Including poisoning scenarios in security awareness sessions, with realistic examples of truncated addresses, helps people internalize why the verification routine exists and why shortcuts are risky.
Periodic reviews of outgoing payments against the registry can also confirm that the process is followed.
Keeping Your Future Payments Safe
The simplest long-term defense is to stop treating transaction history as a source of payment addresses. Build an address book, use allowlists where available, and verify long segments of every destination. These habits cost seconds and remove the attacker’s only path to success.
Review your wallet settings for spam and zero-value filters, and enable them. Keep separate wallets for different purposes so that a cluttered trading wallet is not also the place where you manage savings. A clean, purpose-specific history makes unexpected entries stand out immediately.
Address poisoning sits alongside other address-substitution threats. Clipboard hijacking changes what you paste through malware, while phishing and malicious explorers mislead you through fake websites. Understanding all of them reinforces the same lesson: confirm the destination from a trusted source every time funds leave your control.