Address Poisoning Scam: How It Works and How to Avoid It

Address poisoning plants a lookalike wallet address in your crypto history so you send funds to a scammer. Learn how to spot it and send crypto safely.

Quick answer: An address poisoning scam is a crypto scam in which an attacker plants a lookalike wallet address in your transaction history, usually through a tiny or zero-value transfer, hoping you will later copy it by mistake and send real funds to the attacker. The fake address matches the first and last characters of an address you really use, so a quick glance won't catch it. Never copy a recipient from your transaction history, check the whole address before you send, and save trusted addresses in your wallet's address book. Transfers sent to a poisoned address can't be reversed.

Address poisoning is different from a wallet drainer scam. A drainer tricks you into signing a permission; address poisoning needs no signature and no phishing site. It relies on one copy and paste. This guide explains how the scam works, how to spot a poisoned entry, a safe routine for sending crypto and what to do if you already sent funds.

How an address poisoning scam works

Public blockchains show every wallet's activity, so attackers can see whom you pay and how much. The scam usually runs in four steps:

1. Watch. The attacker monitors transfers on chain, looking for wallets that regularly send meaningful amounts to the same recipients.
2. Generate a lookalike. They create a new address that shares the first and last few characters with an address you recently sent to. Most wallets shorten addresses to something like 0x7a3F…9c21, which is exactly the part that matches.
3. Poison the history. They make a transaction appear in your history that involves the lookalike address.
4. Wait. The next time you pay the same person, you open your history, copy what looks like the usual address and paste it. The funds go to the attacker.

MetaMask's guide to address poisoning puts it plainly: the attack relies on carelessness and haste, and lost funds are irretrievable. The planted transaction can't take anything from you by itself. The damage only happens if you send to the lookalike.

The three ways attackers plant a fake address

Blockchain analytics firm Elliptic describes three common variants:

• Zero-value transfers. The attacker triggers a token transfer of zero from your wallet to the lookalike address. No funds move, but the entry appears in your history as if you sent it. Because the attacker only pays the network fee, Elliptic calls this the cheapest and most widespread method.
• Fake token transfers. The attacker creates a counterfeit token with the same name and symbol as a real one, such as a stablecoin, and logs a transfer with a realistic amount. This is harder to spot than a zero-value entry.
• Dust transfers. The attacker sends a real but tiny amount of a genuine token from the lookalike address. Elliptic says this was the original method and is now less common because it costs the attacker more.

The scale is large. A peer-reviewed study presented at USENIX Security 2025 measured two years of activity on Ethereum and BNB Smart Chain. The researchers counted 270 million attack attempts targeting 17 million victims, and found 6,633 successful incidents that caused at least $83.8 million in losses. They also describe attacker groups that appear to use GPUs to generate lookalike addresses at scale.

How to spot a poisoned address

• A transfer you don't remember. A zero-value outgoing transfer, or a small incoming one from an address you don't know, is the classic sign. Some wallets and block explorers hide or label these, but not all do.
• A suspicious token. A token that shares a well-known symbol but uses a different contract address, or has no value, is likely fake.
• A matching start and end. If two entries in your history show the same shortened address but different full addresses, one of them is poisoned.
• The middle doesn't match. MetaMask advises checking the middle characters, not just the start and end, because the middle is what attackers can't cheaply copy.
• Timing. Poisoning entries tend to appear soon after a genuine transfer, so the fake one sits close to the real one. The USENIX study lists timing, along with address similarity, among the conditions for a successful attack.

Lookalike addresses work like lookalike domains: they exploit the parts of a string people actually read. Our guide to typosquatting and homoglyph domains covers the same trick on websites.

A safe routine for sending crypto

1. Never copy from transaction history. Take the address from the recipient directly, or from an exchange's deposit page you opened yourself.
2. Use the address book. Save addresses you have verified. MetaMask recommends this so you never need to copy from history.
3. Compare the full address. Check it character by character, or at least several characters from the start, the middle and the end, against the source.
4. Send a test amount for a large or first-time transfer, and ask the recipient to confirm it arrived before you send the rest.
5. Confirm on a hardware wallet. Most hardware wallets show the full destination on the device screen before you approve.
6. Read wallet warnings. Some wallets compare the destination with your history and warn when it resembles an address you used before, or when you have never sent to it. Treat that warning as a stop sign.

Sent crypto to a poisoned address? What to do

Be realistic: blockchain transfers can't be reversed, and nobody can undo one for you. Some cases do end with funds returned. Elliptic describes a May 2024 case in which a trader nearly lost $68 million in wrapped bitcoin to a poisoned address and the assets were returned after tracing, negotiation and public pressure. That is the exception, so act quickly:

1. Record the evidence. Save the transaction hash, your address, the attacker's address, the time and the amount.
2. Stop using the poisoned history. Delete or ignore the lookalike entries, and save the correct address in your address book.
3. Report it. In the US, file a report with the FBI's Internet Crime Complaint Center. If the funds move to a known exchange, send that exchange the transaction details. Elsewhere, use the channels in how to report a scam.
4. Ignore recovery offers. People who offer to trace and recover your funds for an upfront fee are running a scam of their own. The FBI's 2025 Internet Crime Report counted 10,516 recovery scam complaints with $1.4 billion in reported losses.

Your wallet itself is not compromised by address poisoning, so your recovery phrase and private keys are still safe. If you also connected to a suspicious site or signed something, follow the steps for a drainer instead.

For exchanges and wallet providers

Elliptic's advice to platforms includes hiding or separating zero-value transfers in customer histories, flagging withdrawals to addresses that resemble a customer's previous counterparties, and warning before transfers to new addresses. Clear guidance in your help centre and withdrawal screens also helps, because the attack depends on a rushed customer. Poisoning often runs alongside other impersonation, such as fake support accounts and cloned sites, which we cover in brand protection for crypto exchanges. Phishvoid finds and takes down the phishing sites and fake profiles in that mix.

FAQ

Can address poisoning steal crypto without my approval?

No. The planted transfer can't move your funds. The loss only happens if you send funds to the lookalike address yourself, usually by copying it from your transaction history.

Why do I have zero-value transactions in my wallet?

They are often address poisoning attempts. Someone triggered a zero-amount token transfer so a lookalike address appears in your history. Don't interact with it, and don't copy addresses from that history.

Is my wallet hacked if I was address poisoned?

No. Address poisoning doesn't touch your keys or recovery phrase. It only adds misleading entries to your history, so the wallet is still safe to use with careful habits.

Can I get crypto back from a poisoned address?

Usually not, because blockchain transfers are final. Record the transaction hash, report it to the authorities and any exchange that receives the funds, and ignore anyone who offers recovery for a fee.