How to Spot an Address Poisoning Attempt in Your History

Key Takeaways

1. Address poisoning does not hack your wallet. It hacks your habits. Attackers plant a lookalike address in your transaction history and wait for you to copy it by mistake.
2. The tell is almost always in the middle of the address, in the value, or in the token name. Matching first and last characters are exactly what the attacker paid for, so they prove nothing.
3. The only reliable defence is process, not eyesight. Use a saved address book entry, verify the full string, and never copy a destination address out of your recent activity list.

What Address Poisoning Actually Is

Address poisoning, sometimes called address spoofing, is a phishing technique that targets the way people reuse addresses. The attacker does not need your seed phrase, your private key, or a bug in your wallet software. The attacker only needs you to copy the wrong string.

The attack runs in four steps:

1. The attacker watches the chain for a wallet that moves meaningful value to a repeat destination, such as an exchange deposit address, an over the counter desk, or a cold storage wallet.
2. The attacker runs a vanity address generator until it produces an address that shares the first few and last few characters with that real destination.
3. The attacker pushes that lookalike address into your visible history using a tiny transfer, a zero value transfer, or a fake token event.
4. The attacker waits. Sometimes for minutes, sometimes for months.

Researchers at Carnegie Mellon University who scanned Ethereum and BNB Smart Chain between July 2022 and June 2024 recorded more than 270 million poisoning attempts against roughly 17 million addresses, with 6,633 successful transfers worth at least 83.8 million US dollars. The security firm Blockaid reported that it flagged more than 65 million poisoning transactions from January 2025 onward, of which roughly one in two hundred ended with a victim actually sending funds. Both figures are estimates based on the detection methods used, but they agree on the shape of the problem: enormous volume, low hit rate, very large individual losses.

Why the Trick Works

Wallets and block explorers shorten addresses so they fit on screen. A 42 character Ethereum address is displayed as something like 0xd9A1b0...53a91. Humans compare what they can see, which is the start and the end. Attackers generate their fake addresses to match precisely those characters, because the middle is hidden anyway.

The economics also favour the attacker. After Ethereum's Fusaka upgrade on 3 December 2025 lowered fees, Blockaid recorded poisoning attempts rising from about 628,000 in November 2025 to about 3.4 million in January 2026. Coin Metrics separately observed stablecoin dust climbing from roughly 3 to 5 percent of Ethereum transactions to roughly 10 to 15 percent after the upgrade, including one attacker contract that reportedly sent around three million dust transfers to more than a million addresses for a total cost of about 5,175 US dollars. When spamming a million wallets costs less than a used laptop, spam is the rational strategy.

The Shapes a Poisoned Entry Takes

Poisoned entries do not all look the same. Learning the four common formats makes them much easier to catch.

Seven Signs of an Address Poisoning Attempt

Run through this list whenever you open your activity tab.

1. An incoming transfer you did not expect. Nobody sends you 0 USDT for a good reason.
2. A value of zero, or an absurdly small value. Zero value token entries are the single most common poisoning artefact.
3. Two entries in your history whose truncated forms look identical. If your list shows 0xd9A1b0...53a91 twice but they are different transactions, expand both. One of them is fake.
4. The middle characters do not match. In the May 2024 case that cost a user 1,155 wrapped bitcoin, the real address began 0xd9A1b and the fake one began 0xd9A1c. Everything else at both ends matched.
5. A token that looks familiar but is not on your holdings list. Fake USDT and fake USDC contracts are common. Check the contract address, not the symbol.
6. A burst of similar entries in a short window. One Etherscan user reported receiving 89 address watch alerts within thirty minutes of making two stablecoin transfers.
7. Dust that arrives immediately after you send a test transaction. This is now a documented tactic. In a December 2025 incident, an attacker detected a 50 dollar test transfer, planted a spoofed address, and the victim sent 49,999,950 USDT to it about 26 minutes later.

How to Verify an Address in Under a Minute

Step 1. Never source the address from your history. Take it from a saved address book entry, from the exchange deposit page itself, or from a message confirmed with the recipient through a separate channel.

Step 2. Check the full string, not the ends. Paste the address you are about to use and the address you know is correct into a plain text editor, put them on two lines, and compare. Any difference is disqualifying.

Step 3. Use the explorer's highlight tools. Etherscan colour codes address segments so two similar addresses do not render identically, and it labels known spoofed tokens and phishing addresses.

Step 4. Send a test transaction, then confirm it landed. A test is useful only if you verify receipt with the recipient independently. Attackers now poison history in the gap between the test and the real transfer.

Step 5. Read the signing screen. On a hardware wallet, the device screen is the trustworthy display. If it does not match what you intended, reject.

Cases That Show the Pattern

The common thread is not carelessness in the ordinary sense. In two of these three cases the victim followed standard advice. The failure point was sourcing an address from a list that an outsider is allowed to write to.

Settings That Reduce Your Exposure

What to Do When You Find One

You cannot delete an entry from a public blockchain, and you do not need to. A poisoned entry is inert unless you interact with it.

• Do not send anything to the address, including a test amount.
• Do not attempt to return the dust. That confirms your wallet is active and invites more.
• Mark or label the address as suspicious in your wallet or explorer so it is visibly flagged next time.
• Report it to your wallet provider or the explorer so it can be added to threat feeds.
• Move on. Your funds are not at risk from the entry itself.

If you have already sent funds to a poisoned address, the transaction is final and no support desk can reverse it. Practical steps are to record the transaction hash, report it to the exchange or protocol if the funds moved onward into a service that can freeze them, report to the relevant national cybercrime authority, and contact a blockchain analytics firm if the amount justifies it. Recoveries do happen, as the May 2024 case shows, but they are exceptional rather than expected.

FAQ

Can someone steal my crypto just by sending me dust? No. Receiving a transfer, including a zero value or dust transfer, does not give the sender any control over your wallet. The risk begins only if you copy their address and send funds to it.

Why can a stranger create a token transfer that appears to come from my own address? Because the transfer event and the actual movement of value are separate things. A zero amount call does not require permission, and a counterfeit token contract can emit whatever events its author wants. Your wallet displays the event.

Are hardware wallets immune to address poisoning? No. A hardware wallet protects your keys and shows you the true destination on a secure screen, but it will faithfully sign a transfer to a wrong address if you approve one. It is a verification aid, not an immunity.

Does this only affect Ethereum? No. The technique works on any chain with long addresses and a visible activity list, including BNB Smart Chain, Solana, Tron, and Bitcoin. Ready made poisoning bots for several chains are sold openly.

Should I move my funds to a new wallet after being dusted? Usually not. Being dusted means your address appeared in public data, which is normal for any active wallet. Improving your address sourcing habits matters far more than changing wallets.

Five Related Terms

• Vanity address: An address deliberately generated to contain chosen characters, used legitimately for branding and illegitimately for poisoning.
• Dusting attack: Sending tiny amounts of crypto to many wallets, used for poisoning or for tracking and deanonymising holders.
• Clipboard hijacking: Malware that swaps a copied address for the attacker's address at the moment you paste it.
• Approval phishing: A related scam where the victim signs a token approval that lets an attacker withdraw funds later.
• Address book whitelisting: Saving and labelling verified destinations, and restricting withdrawals to that list.

Sources

• Tsuchiya et al., "Blockchain Address Poisoning", USENIX Security 2025 / arXiv 2501.16681. https://arxiv.org/abs/2501.16681
• Chainalysis, "Anatomy of an Address Poisoning Scam". https://www.chainalysis.com/blog/address-poisoning-scam/
• Blockaid, "Address Poisoning: The Growing Threat Draining Millions from Crypto Users", 9 March 2026. https://www.blockaid.io/blog/address-poisoning-the-growing-threat-draining-millions-from-crypto-users
• Guan and Li, "Ethereum Crypto Wallets under Address Poisoning: How Usable and Secure Are They?", arXiv 2508.12107. https://arxiv.org/abs/2508.12107
• CoinDesk, "Exploiter Steals $68M Worth of Crypto Through Address Poisoning", 3 May 2024. https://www.coindesk.com/business/2024/05/03/exploiter-steals-68m-worth-of-crypto-through-address-poisoning
• Cointelegraph, "WBTC address poisoner sends nearly all funds back to victim after negotiations", May 2024. https://cointelegraph.com/news/wbtc-address-poisoner-all-funds-negotiations
• Ledger Academy, "What Are Address Poisoning Attacks in Crypto and How to Avoid Them?". https://www.ledger.com/academy/topics/security/what-are-address-poisoning-attacks-in-crypto-and-how-to-avoid-them
• Coin Metrics, State of the Network, issue 349. https://coinmetrics.substack.com/p/state-of-the-network-issue-349

This article is educational content. It is not financial, investment, or legal advice.