Address poisoning is a scam where an attacker sends tiny transactions to your wallet from an address that looks almost identical to one you recently transacted with. When you later copy an address from your transaction history (instead of your contacts), you accidentally copy the attacker's look-alike address and send funds to them. It exploits the habit of copy-pasting from history rather than verifying the full address.
What Is Address Poisoning?
3 min read
The short version
The attacker creates a wallet address that starts and ends with the same characters as someone you actually send money to. They send you a $0 transaction so their lookalike address appears in your transaction history. Next time you send money, you glance at recent transactions, see what looks like the right address, copy it, and send. But you just sent to the attacker's lookalike, not your intended recipient.
How It Works
How it works: (1) Attacker monitors the blockchain for your outgoing transactions and notes your regular recipient addresses. (2) Attacker generates a vanity address that matches the first 4-6 and last 4-6 characters of your recipient (the parts visible in most wallet UIs). This takes computing time but is feasible. (3) Attacker sends a zero-value or dust transaction to your wallet FROM the lookalike address. (4) This transaction appears in your history. Most wallet UIs truncate addresses (showing first 6 and last 4 characters). (5) You go to send funds, scroll through recent transactions, spot what looks like the right address, copy it. You are actually copying the attacker's vanity address. (6) You send $10,000 to the attacker. Transaction is irreversible. Cost to the attacker: generating the vanity address (a few hours of computing) and one gas fee for the dust transaction (cents to dollars). Profit: whatever the victim sends next.
Losing $68,000 to a poisoned address
You regularly send USDC to your business partner at 0x1a2B...7f9E. An attacker generates address 0x1a2B...7f9E (matching first 4 and last 4 visible characters but different middle). They send 0.001 USDC to you from this address. A week later, you need to send your partner $68,000 USDC. You open your transaction history, see a recent USDC transaction involving an address starting with 0x1a2B and ending in 7f9E. You copy it without expanding to see the full address. You send $68,000. It goes to the attacker. Your partner never receives it. You realize hours later when they ask where the payment is. The funds are already moved through several hops and mixed.
What People Get Wrong
Address poisoning hacks your wallet
Nothing is hacked. Your wallet security is not compromised. The attack exploits your copy-paste habits and the way UIs truncate addresses. It is a social engineering attack against human behavior, not a technical exploit against wallet software.
You can filter out poisoning transactions
Some wallets now filter zero-value and dust transactions to reduce noise, which helps. But attackers adapt by sending small but non-dust amounts (a few cents) to bypass filters. The fundamental defense is always verifying the FULL address, not relying on truncated displays.
Only Ethereum addresses can be poisoned
Any blockchain with visible transaction histories and address truncation in UIs is vulnerable. Bitcoin, Ethereum, Solana, and others can all be targeted. The attack is chain-agnostic because it targets human behavior, not protocol mechanics.
Keep Reading
Sources & Further Reading
- Etherscan Address Labels
Etherscan labeling system that can help identify legitimate vs suspicious addresses
Questions People Also Ask
- How do I protect myself from address poisoning?
- Never copy addresses from transaction history. Instead: use your wallet's address book (saved contacts with labels), verify the FULL address (all 42 characters for Ethereum) before sending, use QR codes when possible, and send a small test transaction before large transfers. Five seconds of verification prevents catastrophic loss.
- Can the poisoned transaction steal my existing funds?
- No. The dust transaction itself is harmless to your balance. It does not access your wallet, steal tokens, or grant any permission. The danger is only in the future action YOU take by accidentally copying the wrong address from history.
- Is there any way to recover poisoned funds?
- Only if the attacker is identified and cooperates (extremely rare) or if funds land on a centralized exchange that freezes the account at law enforcement request (possible but slow and uncertain). In practice, funds sent to an address poisoner are usually unrecoverable. Prevention is the only reliable protection.