You copy your own wallet address from your transaction history, paste it into your wallet, hit send — and your crypto goes to a thief. You didn’t mistype anything. The address you pasted just looked like yours. That’s address poisoning, one of the sneakiest scams in crypto.
The trick is embarrassingly simple: crypto addresses are long strings nobody reads in full. Scammers exploit that by planting a lookalike address in your history and betting you’ll copy it next time you send funds.
id=”how-address-poisoning-works”>How Address Poisoning Works
First, the scammer generates a “vanity” address that shares the first and last few characters of your real address — for example, your address starts with 0x7a3f and ends with 9c2e, and so does theirs. Matching a few characters is computationally cheap; matching the whole thing is impossible, but they don’t need to.
Then they send you a tiny dust transaction from that lookalike address. It now appears in your wallet’s transaction history. Later, when you go to send crypto and copy an address from history instead of your address book, you grab the poisoned one. The middle characters differ, but since most people only glance at the start and end, the theft goes unnoticed until the funds are gone.
How to Protect Yourself
The defense is a habit, not a tool: never copy addresses from your transaction history. Always send from a saved address book entry, a QR code, or a freshly pasted address from the recipient. Before confirming any send, check the full address character by character — or at minimum, verify a long chunk in the middle, not just the first and last characters.
Many modern wallets now hide or flag tiny unknown incoming transactions. Keep your wallet app updated so you get these protections. As an extra layer, start large transfers with a small test send to confirm the address is right — a habit that also helps with cross-chain transfers where mistakes are equally final.
What to Do If You’ve Been Poisoned
If you notice dust transactions from unknown lookalike addresses, don’t interact with them — just ignore them. They’re harmless until you copy the address. If you’ve already sent funds to a poisoned address, the transaction is irreversible; there’s no mechanism to recall crypto sent to the wrong address.
You can report the scammer’s address to block explorers (many let you flag addresses), which helps warn others. But recovery is essentially impossible, which is why the copy-from-history habit is the thing to kill.
The Bottom Line
Address poisoning is a copy-paste trap: a fake address that looks like yours, sitting in your history, waiting for a careless moment. Break the habit of copying from history, verify full addresses, and this scam can’t touch you. This guide is for education only — not financial advice.
