Every wallet address is a long string of characters. Most users cannot hold that string in memory. They rely on shortcuts: the first four or five characters, the last four or five, maybe a glance at the middle. Wallets reinforce this by abbreviating addresses on screens (0x742d...8b91). This shortcut is efficient for humans, and it is exactly what the address poisoning attack exploits.
The premise is that if an attacker can generate a wallet address whose first and last characters match an address you have recently interacted with, they can bait you into sending to the attacker's address by mistake. The attack does not require compromising your wallet, your email, or any account. It only requires that you copy an address from a source you trust — your transaction history — and that the source has been quietly seeded with the attacker's lookalike.
Step 1: The Attacker Chooses a Target
Address poisoning is most effective at scale, but the biggest individual hits target specific high-value wallets. The attacker monitors chains for large transfers. When a wallet makes a $500,000 stablecoin transfer to an exchange deposit address, the attacker notes:
- The sender wallet (the target for the next poisoning cycle).
- The receiver address (the address the target trusts).
- The pattern of activity suggesting future repeat transfers.
Whales, DAO treasuries, exchange hot wallets, OTC desks, and accounting teams are all recurring targets because they perform repeat large transfers.
Step 2: The Attacker Generates a Lookalike Address
Wallet addresses are not random strings — they are the hash of a public key. But the space of valid addresses is huge (2^160 on EVM chains), and with enough computation you can brute-force a public key whose resulting address matches a specific prefix or suffix.
Specialized tools (profanity-style vanity address generators, run on GPUs or cloud clusters) can generate addresses matching the first 4–6 characters in minutes and the last 4–6 characters in hours. With enough compute, matching 8+ characters on each end is also possible.
A real target address might be:
0x742d35Cc6634C0532925a3b844Bc9e7595f8b91a
And a successful poisoning might produce:
0x742d35Ab8f7c8d9a1234f3B844Bc9e7595f8b91a
Notice the first 6 characters (0x742d35) and the last 6 (f8b91a) match. The middle 28 characters are completely different — but the human eye does not check the middle.
The Key Asymmetry
A legitimate address is 42 characters on Ethereum. A wallet UI typically displays 10 of them (0x742d...8b91). The other 32 characters — where the actual difference lives — are never seen unless you open the full address explicitly.
Step 3: The Dust Transaction
The attacker then sends a tiny transaction from the lookalike address to the target's wallet. This is often:
- A transfer of 0 tokens with a fake ERC-20 emit event.
- A "dust" transfer of 0.0001 of some token.
- A fake USDC or USDT token (same symbol, different contract) transferred in.
The effect is that the lookalike address now appears in the target's transaction history, specifically in the "recent counterparties" or "recent sent/received" list that most wallets and explorers display.
Step 4: The Bait Takes
At some later time — hours, days, or weeks — the target goes to send another transfer to their real counterparty. They open their wallet or MetaMask, click "recent transactions" or "address book from recent," and see an abbreviated address that matches the first and last characters of their expected destination.
They click it. They enter the amount. They hit send.
The funds go to the attacker.
Variants and Enhancements
Fake Token Name Variant
A stronger version sends a token that is a custom ERC-20 spoofing USDT or USDC — same symbol, same decimals, different contract. The transaction appears as "received 500 USDT from 0x742d...8b91a." The victim now has not just a matching address in history but a matching address that appears to have sent them legitimate stablecoins.
Zero-Value Transfer Variant
The attacker exploits the ERC-20 transferFrom event. Without actually moving any tokens, they can emit a Transfer event from the target's wallet to the lookalike address. The target's wallet history shows "you sent 500 USDC to 0x742d...8b91a" — which looks to the target like confirmation that they have done business with that address before.
Multi-Chain Variant
Some attackers run the poisoning on chains the target uses less frequently (Arbitrum, Base, Optimism) where the victim has less muscle memory and is more likely to copy without thinking.
Defense: Habits That Actually Work
Never Copy Addresses From Transaction History
The single most effective rule. Your transaction history is an untrusted surface — anyone can insert entries into it. Always copy from a trusted source: the counterparty's own message, a saved address book entry you created manually, or the exchange's official deposit address page.
Verify More Than the First and Last Characters
At minimum, verify 8–10 characters in the middle of the address when sending large amounts. For very large transfers, verify the full address by reading it out loud or comparing it side by side.
Use a Saved Address Book With Labels
Most wallets support a contacts list. Save verified counterparties with human-readable names. Send to "My Coinbase Deposit" rather than copying a string.
Send a Test Transaction First
For any transfer above a threshold you can live with losing, send $10 first. Wait for confirmation from the receiver. Then send the full amount. This habit alone has saved many institutional transfers.
Hide Spam Tokens and Dust Transfers
Most wallets now support marking dust tokens as spam, which hides them from the active history view. Enable this. It reduces the surface area where poisoning attempts appear.
Use Hardware Wallet Address Verification
Hardware wallets display the destination address on their built-in screen before signing. Always verify the on-device display matches what you intended — not just the abbreviated version in the desktop UI.
If You Catch It Immediately
The window to act on an address-poisoning transfer is narrow but non-zero:
- Identify the destination address and the transaction hash.
- Run a forensic trace to see where the funds moved. If they are still at the initial drainer wallet or at an exchange deposit address, there is potential. See the first 72 hours guide for the full action sequence.
- Contact the exchange's compliance team with the transaction details. Major exchanges can freeze deposits within hours of receipt.
- File an IC3 complaint and, for large losses, engage both civil counsel and federal authorities. Read our full blog post on address poisoning attacks for more detail.
- Document everything — the poisoning transaction, the original legitimate counterparty, and the intended recipient — for any subsequent investigation.
Recovery odds drop sharply after the funds move from the initial deposit. The first 60 minutes are by far the most important. See when stolen crypto can realistically be recovered for what's possible after that window.