Address Poisoning: What It Is and How to Protect Yourself

Address poisoning doesn't require malware, social engineering, or a fake investment platform. It exploits one single habit: copying wallet addresses from your own transaction history. And it has cost victims millions.

This article explains exactly how it works, why it's so effective, and the specific habits that make you immune to it.

What Address Poisoning Actually Is

The attack requires no interaction from you. You don't click a link, install software, or respond to a message. The scammer simply sends a dust transaction — sometimes as little as $0.00 — and waits. Their poisoned address sits in your history, looking like a trusted one.

All they need is for you to be in a hurry once.

How the Attack Works Step-by-Step

1. 1

   Scammer identifies a target address

   They monitor the blockchain for wallets with regular transaction activity — particularly wallets that frequently send to or receive from the same addresses.

2. 2

   Generate a look-alike address

   Using a vanity address generator, they create a wallet address that matches the first 4-6 and last 4-6 characters of a legitimate address in your history. The middle characters are completely different — but you'll never see them.

3. 3

   Send a tiny "dust" transaction

   The attacker sends a micro-transaction (sometimes $0.00 using token transfer mechanics) from their look-alike address to your wallet. This transaction now appears in your history.

4. 4

   Wait for you to copy from history

   When you next need to send funds to that address, you open your transaction history, see the familiar-looking address near the top, and copy it. You've just copied the attacker's address.

5. 5

   Funds sent to wrong address

   You confirm the transaction. The funds go to the attacker. The blockchain is irreversible — there is no undo.

How Scammers Create Look-Alike Addresses

A standard Ethereum address is 42 characters long. Most wallets, exchanges, and block explorers display only the first 6 and last 4 characters — the rest is hidden by default with "..."

Here's what a poisoned address looks like compared to a real one:

The highlighted characters — the ones you'd actually see in a wallet UI — are identical. The 30+ characters in the middle are completely different. This is not a coincidence; the attacker specifically generated this address to match.

Vanity address generators can try millions of combinations per second. Matching 8-10 visible characters is achievable in minutes with consumer hardware. Matching 12+ takes longer but is still feasible for a motivated attacker targeting a high-value wallet.

A Real-World Example

In 2023, a trader lost $68 million in a single address poisoning transaction. They had been regularly sending USDT to a specific address. The attacker generated a look-alike, poisoned their history, and waited. The trader copied from history without checking the full address. The $68 million transfer confirmed before they realized the error.

Smaller cases happen constantly and go unreported. The victim sends $5,000 to an address that "looked right," realizes hours later, and finds nothing they can do about it.

Why This Scam Is So Effective

Three reasons address poisoning works on experienced users:

• Transaction history feels trustworthy. You've used that address before. Seeing it again in your history triggers confirmation bias — your brain says "I recognize this."
• Full address verification is inconvenient. A full Ethereum address is 42 characters. Nobody wants to read 42 characters. Interfaces truncate them. Attackers exploit that truncation.
• Speed and habit create windows. You're moving funds during a busy moment. You've copied addresses from history hundreds of times without issue. This time is no different — until it is.

It's also a scalable attack. A single attacker can poison thousands of wallets simultaneously. They don't need all of them to fall for it — even a small success rate against high-value wallets is enormously profitable.

How to Protect Yourself

If You Already Sent Funds to a Poisoned Address

The transaction cannot be reversed. But that doesn't mean nothing can be done.

Here's what to do immediately:

• Document everything. Screenshot your transaction history, the poisoned address, and the legitimate address side by side. Record the transaction hash, amount, and timestamp.
• Run the poisoned address through a block explorer. See where the funds moved next — whether they went directly to an exchange, through mixers, or into other wallets. This tells you how fast you need to move.
• Report to the destination exchange immediately. If the funds landed at a centralized exchange, contact their fraud team and provide the transaction hash. Some exchanges will freeze accounts pending investigation if contacted quickly.
• File reports with IC3, FTC, and CISA. Federal agencies track address poisoning campaigns. Your report contributes to pattern recognition even if no immediate action is taken. See our guide on reporting malicious wallet addresses.
• Engage a forensic investigator. A blockchain forensic report traces the full fund flow, identifies exchange deposit addresses, and produces a document law enforcement can act on. Start by gathering your transaction evidence.

The window for exchange cooperation closes quickly — often within 24-72 hours before funds are moved to non-custodial wallets or exchanged. Follow the first 72 hours checklist to act in the right sequence. If significant funds were lost, act on the exchange contact and forensic investigation simultaneously, not sequentially.