Address Poisoning
Scam where attackers mimic your address to trick you.
Address poisoning is a crypto scam that places a lookalike wallet address in a person's transaction history. The attacker hopes the victim will later copy the fake address and send funds to it. The scam exploits visual shortcuts and payment habits rather than breaking blockchain cryptography or directly stealing a private key.
Attackers first study public transactions to find addresses that regularly exchange valuable assets. They generate an address with several matching characters at the beginning and end, the parts most wallet interfaces display. They may then send a tiny amount of a token to the target or create a misleading zero-value token transfer. When the victim searches their recent activity for a familiar recipient, the poisoned entry looks close enough to be selected by mistake.
For example, a treasury operator who pays a contractor each month might copy the destination from last month's history. If a malicious address has the same first four and last six characters as the contractor's address, a shortened interface may make both appear identical. One careless copy can route the entire payment to the scammer. Generating a convincing partial match can be cheap, while a successful mistake may be irreversible.
Address poisoning matters to individual users, exchanges, DAOs, and any company making on-chain payments. It can affect hardware wallet users and multisig teams because secure signing devices still approve the destination shown to the signer. Multiple approvals offer limited protection if every signer checks only the shortened address or trusts the transaction preparer.
The strongest defense is a verified payment workflow. Use an address book, allowlist, signed invoice, verified naming service, or known contract configuration. Compare the full destination on the signing device with a trusted source, not only the first and last characters. For a new or changed destination, confirm it with the recipient through a separate communication channel and send a small test payment. Teams should require extra review for address changes and high-value transfers.
Unrequested dust does not by itself compromise an account. Do not click links in token names, visit sites advertised through transfers, or attempt to claim unknown assets. Wallet providers can help by flagging spam and showing complete addresses, but users still own the final verification step. If funds are misdirected, save the transaction hash and report the attack quickly, while recognizing that no central party can normally reverse a settled transfer.
Frequently asked questions
- An attacker creates a lookalike address and sends a tiny token transfer, or fabricates a zero-value transfer event, so it appears in the victim's history. The attacker expects the victim to copy that familiar-looking entry during a later payment. Because wallet screens often shorten addresses, matching first and last characters can make the malicious destination seem genuine.
- Copy the destination from a verified invoice, saved address book, allowlist, or the recipient's wallet, never from recent transaction history. Compare the complete address on a trusted screen and confirm it with the recipient through another channel. Use a small test transfer for valuable payments, then verify that the recipient received it before sending the balance.
- Receiving a suspicious dust or zero-value transfer does not mean your wallet has been hacked. Hide or label the entry and avoid interacting with attached links or tokens. If you sent assets to the attacker, record the transaction hash, notify the sending exchange or wallet provider, and report the address. Recovery is unlikely because confirmed blockchain transfers are normally irreversible.