What Is Address Poisoning?

Address poisoning is a scam in which an attacker creates an address that starts and ends like one you use, then sends a tiny or zero-value transfer so it appears in your history. If you later copy that address, you pay the attacker. In May 2024, one victim sent 1,155 WBTC, about $68 million, this way.

How the attack works

1. Watch: bots monitor wallets that move large amounts.
2. Generate: the attacker creates an address matching the first and last characters of an address you send to often.
3. Poison: they send a dust or zero-value token transfer from the lookalike address, so it shows in your history. Some tricks even make it look as if you sent funds to it.
4. Wait: you copy the “familiar” address from your history for your next transfer, and the funds go to the attacker.

No password, seed phrase or signature is stolen. The attack relies on wallets and explorers shortening addresses and on people checking only the first and last few characters.

Figure: A lookalike address matches the start and end; only the middle differs (illustrative addresses).

Why lookalike addresses are cheap to make

An address is derived from a randomly generated key, so attackers cannot choose it directly. They can, however, generate millions of keys quickly and keep the ones whose addresses happen to start and end with the same few characters as yours. Matching four characters at each end takes ordinary computing power; matching more takes longer but is still feasible for well-funded attackers. Because most wallets and explorers display addresses in shortened form, such as the first and last four characters with dots in between, a lookalike that matches those visible parts can pass a quick glance.

Variants of the trick

• Dust transfers: the attacker sends a tiny real amount from the lookalike address, so it appears in your incoming history.
• Zero-value transfers: on some token contracts, anyone can trigger a transfer of zero tokens that appears to come from your own address, placing the lookalike in your outgoing history.
• Fake tokens: the attacker creates a token whose name copies a real one and sends a transfer that looks like a payment you made.

All three aim at the same habit: copying an address from your own transaction history.

The scale

Researchers at Carnegie Mellon documented about 270 million address poisoning attempts on Ethereum and BNB Chain between July 2022 and June 2024, targeting about 17 million wallets, with at least $83 million in confirmed losses. In the May 2024 WBTC case, the attacker returned most of the funds after public negotiation, an exception rather than the norm.

A record loss, and an unusual ending

On May 3, 2024, one victim sent 1,155 wrapped bitcoin, worth about $68 million at the time, to a poisoned address after copying it from their history. The case drew wide attention not only for its size but for what followed: after on-chain messages and public pressure, the attacker returned almost all of the funds days later. Such outcomes are rare. In most cases, funds sent to a poisoned address are not recovered.

Not only an Ethereum problem

Most recorded attacks happen on Ethereum and similar networks, where zero-value transfers and cheap token transactions make poisoning easy. Bitcoin is not immune: an attacker can still send a small amount from a lookalike address so that it appears in a wallet’s history, and the same copying habit leads to the same loss. The defense is identical on every network: never rely on history as a source of addresses.

How to check an address properly

• Copy from the source, such as the exchange’s deposit page or the recipient’s own message, not from your history.
• Compare the whole address in chunks, for example four characters at a time from start to finish, rather than only the ends.
• Use your hardware wallet’s screen to confirm the address before approving, since it shows the full string.
• Save trusted addresses in an address book once, after verifying them, and select them from there.
• Confirm a test transfer arrived with the recipient before sending the rest.

The same discipline applies when receiving. If you share your address for a payment, send it through a channel the other person trusts and ask them to confirm the first and last characters back to you. Attackers who can see your public activity sometimes contact senders directly with a lookalike address and a believable story, so a quick confirmation through a second channel closes that route as well, at almost no cost to anyone. A single minute of checking is cheap insurance against a permanent mistake.

What wallets are doing about it

Many wallets and block explorers now hide zero-value transfers and suspected spam tokens by default, flag addresses that closely resemble ones you have used, and warn before sending to an address with no history. These features help, but they cannot catch every variant, so the habits below remain the main defense.

If you have sent funds to a poisoned address

There is no way to reverse the transaction. Record the transaction hash, report the address to the wallet provider, any exchange the funds move to and the police, and watch for the funds arriving at an exchange that might freeze them. Be wary of “recovery services” that contact you; they are a common second scam.

How to protect yourself

• Never copy addresses from your transaction history.
• Use an address book or saved contacts for frequent recipients.
• Check the full address, not just the start and end.
• Send a small test transaction before a large transfer, and confirm it arrived.
• Ignore unexpected tiny transfers and tokens from unknown addresses.
• Use withdrawal whitelists on exchanges. See what a crypto address whitelist is.

For safe transfers, read how to withdraw crypto safely. For related scams, see what a wallet drainer is and crypto scam warning signs. For the basics, read what a crypto wallet is.

This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.

Frequently asked questions

Can a tiny incoming transfer steal my funds?

No. The transfer itself cannot move anything out of your wallet. It is bait, placed in your history in the hope that you will later copy the wrong address. Ignoring it, and hiding it if your wallet allows, is enough.

Do human-readable names prevent address poisoning?

They help, because you type or select a name instead of copying a long string. But names can also be impersonated with lookalike spellings, so the same rule applies: check what you are sending to, and send a small test first for large amounts.

Sources

• Hacker Returns 51 ETH to Victim from Stolen $68 Million (May 3, 2024 loss of 1,155 WBTC; later return of nearly all funds) — ForkLog, May 2024
• Address Poisoning (Carnegie Mellon: 270 million attempts, 17 million wallets, July 2022–June 2024) — Spark Research
• Address poisoning (USENIX study: over $83 million confirmed losses) — Spark