Key Takeaways
- Address poisoning does not steal your keys. It tricks you into sending funds yourself to a fake address that looks almost identical to one you trust.
- The attack lives in your transaction history. Scammers plant lookalike addresses there, hoping you will copy the wrong one later.
- Use both verified addresses and wallet safeguards. Save trusted addresses in an address book, verify the full address, and never copy a recipient from recent activity.
What Is Address Poisoning in Crypto?
Address poisoning is a scam where an attacker places a fake wallet address in your transaction history. The fake address is designed to look like an address you have used before, usually by matching its first and last few characters.
The goal is simple. The attacker hopes that the next time you send funds, you will copy the fake address from your history instead of the real one. A confirmed transfer generally cannot be cancelled by your wallet provider. Getting funds back would require a separate return or other intervention, not an ordinary chargeback.
Unlike many hacks, address poisoning does not need your seed phrase, your private key, or access to your device. You approve and send the transaction yourself. Long addresses and shortened displays make the deception easy to miss, even for experienced users.
Why the name "poisoning"?
The attacker "poisons" your wallet history. Your history is supposed to be a reliable record. After the attack, it contains entries that look real but lead to the attacker.
How Big Is the Problem?
Address poisoning is not a rare edge case. A peer-reviewed study by Carnegie Mellon researchers, presented at USENIX Security 2025, measured attacks on Ethereum and BNB Smart Chain from July 1, 2022, to June 30, 2024.
| Measure (July 2022 to June 2024) | Reported figure |
|---|---|
| Poisoning attempts detected | About 270 million |
| Addresses targeted, not necessarily losing funds | About 17 million |
| Successful transfers identified | 6,633 |
| Confirmed losses | At least 83.8 million USD |
The authors describe their loss estimate as a lower bound. Their collection focused on selected stablecoins on two chains; it did not measure all assets or networks. An address is also not necessarily a unique person. The separate WBTC incident below was outside the stablecoin loss calculation. See the research paper.
The study also found that organized groups run these campaigns like a business. Some groups earn many times more than they spend on transaction fees, and they tend to target wallets with large balances or frequent activity.
How an Address Poisoning Attack Works, Step by Step
Most attacks follow the same pattern.
- Watch the chain. On public chains, transaction records let attackers monitor address activity. Attackers use bots to watch for wallets that send stablecoins or other tokens, especially large or repeated transfers.
- Generate a lookalike address. The attacker uses software to create a vanity address that shares the same first and last characters as an address you use. For example, a real address might start with
0x1e2Fand end with9aB4. The fake one will start and end the same way, with different characters in the middle. - Poison your history. The attacker sends a transaction that makes the fake address appear in your activity. This can be a zero value token transfer, a tiny "dust" amount, or a counterfeit token that copies the name of a real one like USDT.
- Wait for a mistake. Many wallets and block explorers shorten addresses on screen, such as
0x1e2F...9aB4. If you copy the recipient from recent activity, the fake one looks identical. - Take the funds. You paste the wrong address, confirm the transaction, and the funds go straight to the attacker.
The three common poisoning methods
| Method | What appears in your history | Why it works |
|---|---|---|
| Zero-value transfer | A token-history entry that may appear to send 0 tokens from your address to a lookalike | Some token contracts allow zero-value transfer calls without spending your funds or exposing your key |
| Tiny transfer (dust) | A very small real token amount from the fake address | It looks like a normal small payment |
| Counterfeit token | An entry emitted by a fake token using a familiar name or symbol | The displayed asset name can mislead you about what actually happened |
Real Examples of Address Poisoning Losses
Two documented cases show how much is at stake.
The approximately $68 million WBTC case, May 2024. A user transferred 1,155 wrapped bitcoin to a lookalike address. Chainalysis's reconstruction places the loss on May 3, 2024, and records the later return of funds in ETH. Dollar valuations varied as prices moved. A voluntary return in one case is not a recovery guarantee for other victims.
The $50 million case, December 2025. Carnegie Mellon CyLab reported that its Toxin Tagger monitoring system detected a successful $50 million address-poisoning attack on December 19, 2025. Its January 2026 account illustrates the continuing risk beyond the study period.
The practical lesson is the same: a successful test payment validates only the address and route used for that test. If you copy a different address for the main payment, the test does not protect it.
How to Avoid Address Poisoning: A Practical Checklist
A consistent sending process can reduce exposure. Wallet warnings help too, but no single check should be treated as a guarantee.
1. Never copy a recipient from your transaction history
This is the single most important rule. Treat your transaction history as a record to read, not a contact list to copy from. Wallet activity and block explorer pages are exactly where poisoned addresses appear.
2. Use an address book or whitelist
Use an address book or address whitelist where your wallet or exchange supports it. Verify the entry independently before saving it, label its network, and check that it remains valid before reuse. Some services change deposit addresses or require a memo or tag. A saved wrong address is still wrong.
3. Verify the full address, not just the ends
Attackers match the first and last characters on purpose. Check the middle section as well. A good habit is to compare characters in groups of four from start to finish.
4. Get the address from the original source
If you are paying a person or service, get the address through a trusted channel, such as the deposit page in the official exchange app. For a changed payment instruction, confirm through a second contact method you already know. Check the asset, network, and any required memo or tag as well as the address.
5. Do test transactions the right way
A small test can help after you independently verify the recipient. Confirm that the intended person or service actually received it, then compare the main transfer against the same verified address and network. A successful transaction status alone does not establish that the right person received it. Never use a newly appearing history entry as your source.
6. Confirm on a hardware wallet screen
If you use a hardware wallet, compare the full recipient shown on its trusted screen with your independently verified address. It adds a checkpoint, but it cannot identify your intended recipient for you. Reject an action whose details you cannot verify.
7. Turn on spam filters and warnings
Enable available spam filters and transaction warnings. For example, MetaMask documents lookalike-address detection. Coverage varies by wallet and network, and an absence of warnings does not establish that a recipient is safe.
Safe vs Risky Sending Habits
| Risky habit | Safer habit |
|---|---|
| Copying an address from recent activity | Selecting a saved address book entry |
| Checking only the first and last characters | Checking the full address |
| Sending a test, then copying from history | Sending the test and main transfer to the same saved address |
| Following a link attached to an unknown token to “claim” or “remove” it | Hiding spam through your wallet interface without visiting its advertised site |
| Rushing large transfers | Slowing down and double checking for large amounts |
What to Do If You See Poisoning Transactions
An unfamiliar zero-value or dust entry alone does not prove that your private key was stolen. In a history-poisoning attack, the incoming entry itself does not authorize spending from your wallet. The direct risk is copying the planted address; related spam may also lure you to a phishing site. If real assets leave without your authorization, investigate that separately.
- Do not interact with the unknown tokens or addresses.
- Do not try to "send them back." This can lead you to send funds to the attacker.
- Hide the tokens if your wallet allows it.
- Report or mark the entry as spam if supported; do not save the attacker's address as a trusted contact.
What to Do If You Already Sent Funds to a Poisoned Address
Your wallet provider cannot normally undo a confirmed payment, but prompt reporting can still help an investigation.
- Record the details. Save the transaction hash, the fake address, the amount, and the time.
- Report to authorities. Give local law enforcement the evidence. In the U.S., file with the FBI's IC3.
- Notify the relevant exchange or issuer through official channels. Some custodians and token issuers can restrict particular funds, subject to their processes and legal requirements. A report does not guarantee freezing or reimbursement.
- Secure future transfers. Correct any saved recipient and inspect pending sends. Address poisoning alone does not require replacing your seed phrase; a separate key exposure or unauthorized spending incident does.
- Beware of recovery scams. People who promise to "recover" your crypto for an upfront fee are very often scammers themselves.
This information is educational and is not legal or financial advice.
Which Blockchains Can Be Affected?
The large study described above covered Ethereum and BNB Smart Chain. Its results do not establish a worldwide ranking across blockchains. Reused addresses, low transaction costs, and shortened address displays make large-scale history poisoning easier.
Any workflow that copies a payment address from an unverified history entry can be vulnerable. The important question is whether you verified the destination, rather than assuming that a particular blockchain prevents this mistake.
FAQ
Can address poisoning steal crypto directly from my wallet?
No. Address poisoning cannot move funds out of your wallet on its own. It only works if you send funds to the fake address yourself.
Is a zero value transfer in my history dangerous?
It may be a poisoning attempt, but not every zero-value transfer is malicious. The entry alone does not give someone spending access. Do not copy an address from it or follow links attached to unfamiliar tokens.
Does sending a test transaction prevent address poisoning?
Not by itself. Independently confirm receipt of the test, then verify that the main transfer uses the same trusted destination and network. Do not fetch the recipient from transaction history afterward.
Can I get my money back after an address poisoning scam?
Recovery is uncertain. Funds have been returned in some cases, but a wallet cannot simply reverse the payment. Report promptly through official channels and do not pay anyone who guarantees recovery.
How is address poisoning different from a dusting attack?
A classic dusting attack sends small amounts to track wallet activity and reduce privacy. Address poisoning uses similar small transfers, but its goal is to trick you into sending funds to a lookalike address.
Related Terms
- Dusting Attack: A privacy attack that sends tiny amounts of crypto to addresses and analyzes subsequent activity to try to link them.
- Vanity Address: A wallet address generated to contain chosen characters, which scammers use to mimic real addresses.
- Address Whitelisting: A security setting that only allows withdrawals to addresses you have approved in advance.
- Hardware Wallet: A physical device that stores private keys offline and shows transaction details on its own screen.
- Block Explorer: A website that lets anyone view blockchain transactions, addresses, and balances in public.
Sources
- Tsuchiya et al.: Blockchain Address Poisoning, USENIX Security 2025
- Research paper: Blockchain Address Poisoning
- Carnegie Mellon CyLab: Study results and December 19, 2025 incident, January 7, 2026
- Chainalysis: Anatomy of an Address Poisoning Scam, October 23, 2024
- MetaMask: Address-poisoning scams and safeguards
- FBI Internet Crime Complaint Center
Sources checked October 16, 2026. This guide is educational and does not guarantee the safety or recovery of funds.
