Address Poisoning Scams

Address poisoning is a scam that exploits the common practice of copying a wallet address from a recent transaction history rather than re-entering it manually. Because cryptocurrency wallet addresses are long, complex strings of characters, most users copy and paste them to avoid errors. Address poisoning turns this convenience into a vulnerability.

The scammer generates a wallet address that closely mirrors a legitimate address you use frequently — typically matching the first several and last several characters, which are the parts most people check when verifying. This near-duplicate address is then 'poisoned' into your transaction history by sending a tiny, near-valueless transaction to your wallet from it. The transaction now appears in your history sitting near a real transaction to or from the genuine address.

The next time you need to send funds to that genuine address and look at your history to copy it, you may accidentally copy the scammer's lookalike address instead. The funds you send go directly to the scammer.

The attack requires no technical exploitation of your wallet and no malware. It exploits human behaviour — the habit of copying from history and the practical difficulty of manually verifying a full 40-character address character by character.

Address poisoning has resulted in significant losses even among technically experienced crypto users, because the check most people perform — verifying the first and last few characters — is precisely what the scammer's address is designed to pass.

The scammer monitors public blockchain transaction data to identify wallets that have made or received transactions involving addresses they want to impersonate. Because all transactions on public blockchains are visible to anyone, the scammer can see every address your wallet has interacted with.

They then generate a vanity address — an address with a chosen prefix and suffix — that matches the target address in its first several and last several visible characters. Address generation tools can produce these vanity addresses quickly.

A dust transaction (a tiny amount of cryptocurrency or a valueless token) is sent from this lookalike address to your wallet. This creates an entry in your transaction history that appears near — or even immediately above or below — a legitimate transaction involving the genuine address.

When you next go to send funds and look at your transaction history to copy the recipient address, your eye is drawn to the similar-looking entry. If you copy the poisoned address rather than the genuine one, you send your funds directly to the scammer. The blockchain confirms the transaction — it is a valid transfer to a valid address — and the funds are gone.

The attack succeeds because it targets a specific gap between security knowledge and practical behaviour. Most crypto users know they should verify addresses carefully, but in practice, checking the first and last few characters of a long address has become a standard shortcut. Address poisoning is specifically engineered to defeat this shortcut.

The transaction history interface in most wallets presents addresses truncated for readability — showing only the first and last several characters. This display format, intended to help users, is precisely what makes the attack difficult to detect at a glance.

A person regularly sends cryptocurrency to a business counterpart and copies the recipient address from their recent transaction history each time. One day, they notice a tiny incoming transaction from an address that looks identical to their counterpart's. They do not question it. On the next payment occasion, they copy an address from their history — the poisoned one — without comparing every character. The payment is made, confirmed on-chain, and gone. When the counterpart reports not receiving the funds, both parties examine the transaction and realise the destination address differs in the middle characters.

No message — the attack is entirely on-chain via a dust transaction. The scammer sends [small amount] to your wallet from [lookalike address] to plant it in your history.

[Lookalike wallet address] — designed to match first and last characters of your real contact's address.

Never copy a wallet address from your transaction history without verifying every character against an independently trusted source — such as a saved address book entry, the payee's website, or a message you received through a channel you trust.

When pasting an address, hover over or expand it in your wallet interface to view the full string, and compare it character by character against your trusted source. Even one character difference means it is a different address.

Consider using your wallet's built-in address book feature to save frequently used addresses. Addresses saved in your address book were saved by you at a known-good moment — copying from there avoids copying from potentially poisoned transaction history.

For high-value transactions, confirm the destination address with the recipient via a separate communication channel before sending.