Imagine copying a wallet address from your transaction history, pasting it into a send, and watching your crypto vanish to a stranger. You double-checked it — or thought you did. You’ve likely just met an address poisoning attack, one of the sneakiest scams in crypto.
The attack works because crypto addresses are long and humans are lazy: we check the first and last few characters and assume the middle matches. Attackers exploit exactly that habit. Here’s the simple 4-character check that defeats it.
id=”what-address-poisoning-is”>What Address Poisoning Is
Attackers generate thousands of wallet addresses until they find ones that start and end with the same characters as addresses you interact with. They then send you tiny “dust” transactions — often worth nothing — from those lookalike addresses, so the fake address appears in your wallet’s transaction history.
Later, when you copy an address from that history instead of from the original source, you grab the attacker’s lookalike. Since the first and last characters match what you expect, your quick glance says “looks right” — and your funds go to the scammer. The blockchain can’t reverse it.
The 4-Character Check
Before you ever hit send, compare at least the first 4 and last 4 characters of the pasted address against the real address from your trusted source — not from your transaction history. Better yet, compare the full address, or at least a longer stretch in the middle where lookalikes differ most.
Even better than checking: stop copying from history altogether. Save trusted addresses in your wallet’s address book, use ENS names you registered yourself, or ask the recipient to confirm via a second channel. And for any first-time transfer, send a tiny test amount and confirm receipt before moving the full sum.
Other Safety Habits That Help
Hide or ignore tiny unknown transactions in your wallet — that’s the poison being planted. Many wallets let you hide spam tokens and unknown activity. Treat any unexpected “refund” or small incoming transfer as suspicious, not lucky.
Modern wallets are adding protections like address warnings and transaction simulation — our account abstraction guide explains how smart wallets catch these tricks. For trade-time protection, see our guide to protecting swaps from MEV bots.
The Bottom Line
Address poisoning turns your own transaction history into a trap. Beat it with one habit: never copy addresses from history, and always verify the first and last characters against a trusted source before you send.
This guide is for education only — not financial advice.
