Address Poisoning Attacks Explained: How to Protect Your Crypto (2026)

There’s a particular scam in crypto that tricks you without ever touching your seed phrase, without sending you a phishing email, and without asking you to click anything shady. Instead, it simply slips a poisoned address into your transaction history and waits for you to copy it yourself.

That’s address poisoning — one of the most quietly dangerous attacks in crypto today. In this guide, you’ll learn exactly how it works, how to spot the fakes in your history, and the simple habits that make you immune to it.

id=”what-is-address-poisoning”>What address poisoning is

Address poisoning is a scam where an attacker “plants” a lookalike wallet address in your transaction history, hoping you’ll later copy it and send crypto to the attacker’s wallet instead of the person you actually intended to pay.

Here’s the key insight that makes this attack possible: most wallets are long, messy strings of characters, and most people only check the first few and last few characters before trusting them. Attackers know this. They use computing power to generate (“grind”) a wallet address that matches the beginning and end of a real address you interact with — say, the exchange you withdraw from or a friend you pay regularly — and then they send a tiny transaction involving you and that fake address.

That tiny transaction now sits in your history. The next time you need the address, you might open your history, see the entry, copy the address, and paste it into your send screen. Your wallet won’t warn you. There is no “wrong address” alarm in crypto — if you send it, it’s gone, and there’s no undo button.

It’s called “poisoning” because the attacker’s address is like a drop of poison mixed into an otherwise legitimate transaction list. The history itself looks normal. Nothing about your wallet is broken or hacked. The trick lives entirely in human behaviour: we copy addresses from convenient places without double-checking them.

Attackers can also poison your history with what’s sometimes called “dust” — tiny amounts of crypto (or zero-value transfers that still show up as entries) sent from the fake address to your wallet. When you later scroll your history looking for “the address I interacted with last week,” the poisoned entry is sitting right there, ready to be copied.

How the attack works step by step

To really understand this scam, let’s walk through it the way an attacker would think about it. This isn’t to help anyone do it — it’s so you can recognise the pattern, because recognition is the entire defence.

Step 1: The attacker watches your wallet

All blockchain transactions are public. An attacker can look up any wallet address and see every transaction it has ever made, along with the addresses on the other end. If you regularly send funds to an address — a friend, a business partner, your own exchange deposit address — that address is visible to anyone who looks.

Step 2: The attacker grinds a lookalike address

The attacker generates thousands (or millions) of wallet addresses until they find one that looks similar to the target address. They’re not trying to match the whole thing — that would be computationally impossible. They’re trying to match the first 4–6 characters and the last 4–6 characters, because that’s what most people actually check.

For example, if your real recipient is 0x8F2a…K7bM, the attacker might grind an address like 0x8F2a…K7bM — identical at both ends, completely different in the middle. On a small phone screen, in a crowded history list, these can be surprisingly hard to tell apart.

Step 3: The attacker sends a tiny transaction

Now the attacker sends a tiny amount of crypto (sometimes dust, sometimes a zero-value transfer) from the lookalike address to your wallet — or they send a small transaction to you that involves the fake address. Either way, the goal is the same: get that fake address into your transaction history with a timestamp.

Step 4: You copy the poisoned address later

Weeks later, you need to send funds to the original recipient. Instead of asking them to confirm their address (or looking it up in your saved address book), you open your transaction history, find a recent entry that looks right, copy the address, and paste it into your wallet. The address feels familiar. The first and last characters match your memory.

Step 5: The funds go to the attacker

You hit send. Your crypto arrives at the attacker’s wallet. Because blockchain transactions are irreversible, there’s no refund mechanism, no chargeback, no “oops” button. The attacker moves the funds on, often through mixers or multiple hops, and your money is effectively gone.

This attack has been running at scale for years — security researchers have documented poisoning campaigns targeting many thousands of wallets, and the technique keeps getting refined. It works precisely because it exploits a habit (copying from history) that feels completely safe.

How to spot a poisoned address in your history

Now that you know how the attack works, let’s get practical. Here’s how to tell a poisoned entry from a legitimate one when you’re reviewing your transaction history.

The lookalike test: check the middle, not just the ends

The single most useful habit is this: never verify just the first and last characters of an address — check the middle too. Attackers match the beginning and end because that’s where humans look. The middle of the address is where the difference hides.

A practical method: when comparing two addresses, read them in chunks. Compare characters 1–6, then characters in the middle (say, 15–22), then the last 6. If any chunk differs, it’s a different address, full stop. No amount of “it looks about right” is good enough.

Suspicious tiny or zero-value transactions

Look through your history for transactions you didn’t initiate: tiny incoming amounts from addresses you don’t recognise, or zero-value transfers you have no memory of. These are the hallmark of a poisoning attempt. Legitimate contacts send you meaningful amounts for real reasons; attackers send dust for one reason only — to plant their address.

Some wallets and block explorers now flag or grey out suspicious dust transactions, but you shouldn’t rely on that. Make “who sent this and why?” a question you ask about any unfamiliar entry.

Compare against a trusted source, every time

Your transaction history should never be the source of truth for an address — it’s only a reminder. Before every significant send, confirm the address against a trusted source: the recipient’s official website (typed by you, not clicked from an email), a message from the recipient on a channel you trust, or your wallet’s saved address book (which you populated once and verified once).

How to protect yourself (5 essential habits)

Good news: address poisoning is almost entirely preventable with boring, repeatable habits. None of these require technical skill — just discipline.

1. Use an address book, not your history

Most wallets let you save named contacts. When you first verify a recipient’s address through a trusted channel, save it in your address book immediately. From then on, always select the recipient from your address book rather than copying from history. This single habit defeats the entire attack, because you never touch the poisoned entry.

2. Verify the full address before every send

Before confirming any send — especially a large one — compare the entire address against your trusted source. Read it character by character, or at minimum in the three-chunk method described above (start, middle, end). Yes, this takes thirty seconds. A thirty-second check is a very cheap insurance policy on your money.

3. Do a test transaction for large sends

If you’re sending a significant amount to an address for the first time (or you have any doubt at all), send a tiny test amount first. Confirm it arrives at the intended destination. Only then send the full amount. This won’t stop poisoning by itself — a poisoned address will also “successfully” receive your test — but it confirms the address is reachable, and combined with full-address verification it’s a strong layer of defence.

If you want to understand the mechanics of getting test amounts onto the right chain first, our guide on refuelling gas on a destination chain covers the same careful-verification mindset.

4. Ignore dust and unfamiliar tokens

Treat any unexpected tiny incoming transaction as suspicious until proven otherwise. Don’t copy its sender’s address, don’t interact with the token, and don’t click any links associated with it. Some poisoned entries come paired with fake tokens whose names or websites are themselves scams — a related attack covered in our crypto drainer attack explainer, where interacting with the wrong thing can drain your whole wallet.

5. Keep your address book clean and your wallet software updated

Periodically review your saved contacts and remove ones you no longer use. Stale entries are another kind of trap — you might copy an old address that’s no longer correct. And keep your wallet software updated: newer versions increasingly include warnings about suspicious transactions, lookalike addresses, and dust.

Understanding what your wallet keys actually control also helps — our private key explainer is a good foundation if you’re new to self-custody.

What to do if you already sent to a poisoned address

Let’s be direct: if you sent crypto to an attacker’s address, the funds are almost certainly gone. Blockchain transactions are irreversible, and attackers typically move stolen funds within minutes. But there are still a few things worth doing.

Stop and assess immediately

First, verify what happened: compare the address you sent to against the intended recipient’s address character by character. Confirm that it really was a lookalike and not a typo. Then check whether the funds are still sitting at the attacker’s address or have already been moved — a block explorer (typed by you, not clicked from a link) can show you this. Don’t get your hopes up, but knowing the situation matters for the next steps.

Report it

Report the attacker’s address to the wallet provider and, if relevant, the exchange you were using. Some services maintain shared blocklists of known scam addresses, and your report can protect the next person. You can also report to scam-reporting databases — again, type the address yourself rather than clicking links from messages.

Secure everything else

If you entered your seed phrase anywhere during the episode — on a fake support site, in a chat, anywhere — treat your wallet as compromised and move your remaining funds to a fresh wallet with a new seed phrase immediately. And review any token approvals you’ve granted recently and revoke the ones you don’t recognise.

Learn the habit that would have stopped it

This sounds harsh, but it’s the most valuable part: figure out exactly where your verification process failed. Did you copy from history? Did you only check the first and last characters? Fix that one step, and you’ll be immune going forward. Almost everyone who gets poisoned was one thirty-second check away from being safe.

Address poisoning FAQs

The Bottom Line

Address poisoning is a patient, low-tech scam that weaponises one of crypto’s most innocent habits: copying an address from your transaction history. The attack costs the scammer almost nothing and can cost you everything you send.

The good news is that the defence is equally simple. Save verified addresses in your wallet’s address book, verify the full address (not just the ends) before every send, do test transactions for large amounts, and treat unexpected dust as a warning sign rather than a gift. Make these habits automatic, and address poisoning simply can’t reach you.

This guide is for education only — not financial advice.