Address poisoning: the look-alike address scam
Address poisoning scammers send tiny or zero-value transfers from addresses that share the first and last characters with one you use, hoping you copy the fake from your transaction history. There is no wallet bug involved. Always copy addresses from the recipient or your address book, and check the whole address.
How it works
- A bot watches the blockchain for transfers, often large stablecoin transfers.
- It generates a "vanity" address whose first and last few characters match your counterparty's address.
- It sends you a zero-value, dust or fake-token transfer from that address so it appears in your history.
- Next time you send, you copy the "familiar" address from history, glance at the start and end, and pay the scammer.
Because wallets and explorers often shorten addresses to something like 0x1234...abcd, the fake looks identical at a glance.
Real cases
| Date | What happened | Source |
|---|---|---|
| 3 May 2024 | A whale sent about $68M in WBTC to a poisoned address; after on-chain negotiation the attacker returned almost all of it within about a week | Unchained, May 2024 |
| 20 Dec 2025 | A trader sent 49,999,950 USDT (about $50M) to a look-alike address after a correct small test transfer; the funds were laundered and a $1M bounty offered | The Block, Dec 2025 |
| 2022–2024 study | About 270 million poisoning attempts on Ethereum and BNB Chain over roughly two years, with at least $83.8M lost across 6,633 incidents | USENIX Security 2025 paper (arXiv, Jan 2025) |
The December 2025 case shows why a test transfer is not enough on its own: the victim's test went to the right address, then the poisoned address was planted in their history before the main transfer.
Where it happens
Mostly on Ethereum, Tron, BNB Chain and other EVM networks, and especially with USDT and USDC, where transfers are large and frequent. Any chain with copyable addresses is exposed.
How to avoid it
- Never copy addresses from transaction history, either in your wallet or on a block explorer.
- Use your wallet's address book for people and accounts you pay often, after checking the address once against the source.
- Check the full address, or at least the middle characters, not just the start and end. Our address poisoning check compares two addresses character by character in your browser.
- Confirm on a second channel for large payments: ask the recipient to read back several middle characters.
- Do a test transfer, then copy the address again from the source for the main transfer, not from history.
- Hide spam and zero-value transfers. Many wallets filter them; turn that on.
- On a hardware wallet, verify the full address on the device screen before confirming.
Related tricks
- Clipboard hijackers: malware that replaces the address you paste. In September 2025 malicious versions of the popular npm packages chalk and debug hooked browser wallets to swap recipient addresses (The Hacker News, Sep 2025).
- Fake tokens with the same name as USDT or USDC, sent to make a poisoned address look legitimate.
If you sent funds to a poisoned address, record the transaction hash and report it quickly to police and, if the funds reach an exchange, to that exchange. Stablecoin issuers can sometimes freeze stolen tokens, but nothing is guaranteed. See crypto wallet scams for next steps.
Frequently asked questions
Can address poisoning steal funds directly from my wallet?
No. The attacker can only send to you. You lose money only if you later send funds to the fake address.
Why did I receive a zero-value transfer I didn't make?
That is the classic sign of address poisoning. Ignore it, don't interact with it, and never copy the sender address.
Does a test transaction protect me?
Only if you copy the address again from the original source for the main payment. In the December 2025 $50M case, the test went to the right place and the main transfer did not.
Can I get my money back?
Rarely. In 2024 an attacker returned $68M after negotiation, but that is unusual. Report quickly to police and any exchange involved.
Which wallets protect against address poisoning?
Several wallets hide zero-value and spam transfers and warn about look-alike addresses, but no feature replaces checking the full address against the source.