Home › Knowledge Hub › Address poisoning
Address poisoning: the scam hiding in your transaction history
Address poisoning is a scam that turns your own transaction history into a trap. An attacker sends you a tiny or zero-value transfer from a wallet address crafted to look almost identical to one you use, matching the first and last characters you glance at. Later, when you copy an address from your history to send funds, you grab theirs by mistake, and the money is gone. It has caused more than 83 million dollars in confirmed losses. The defence is simple: never trust the first and last few characters, and never copy an address from your history.
The scam that needs no hack
Address poisoning does not steal your keys, break your wallet, or trick you into signing anything. It does something quieter and, for that reason, more effective: it plants a decoy in your transaction history and waits for you to copy it yourself. The theft is your own routine, used against you.
It works because of a habit almost everyone has. Crypto addresses are long strings of random characters, so nobody reads the whole thing. We check the first few and the last few, see that they match, and paste. Attackers have built an entire category of fraud on that single shortcut.
How address poisoning works
The attack has a setup phase and a payoff phase, and the gap between them is what makes it dangerous.
They generate a look-alike address. Using software, an attacker creates a wallet address whose first and last characters match an address you frequently send to, an exchange deposit address, a second wallet of your own, a regular counterparty. The middle is entirely different, but the middle is the part nobody checks.
They plant it in your history. They send you a transaction from that look-alike address so it appears in your wallet's history as something you have interacted with. Often this is a zero-value or tiny transfer, which is powerful because it can be made to appear without your signature and is easy to overlook. Sometimes it is a small amount of a worthless or fake token, a technique related to "dusting."
You copy it later. Days or weeks on, you go to send funds to the real address. You find a recent-looking entry in your history, confirm the first and last characters match, and paste. They do match, because that is the whole point. The funds go to the attacker, and on a public blockchain the transfer is final.
This is not a minor problem
The losses are large and growing. Industry analysis puts confirmed address-poisoning losses at over 83 million dollars. In a single case in May 2025, a trader lost 2.6 million dollars in USDT across two back-to-back zero-value-transfer scams. A year earlier, in May 2024, another victim lost around 68 million dollars in wrapped Bitcoin, reportedly more than 97 percent of their holdings, to a look-alike address. Blockchain analysts at Chainalysis reportedly linked a single campaign to more than 82,000 wallets, specifically targeting users with high balances.
These are not careless beginners. They are experienced users caught by a habit that usually serves them fine.
How to defend against it
The good news is that the defences are simple, cheap, and completely effective. The trap depends on one shortcut, so removing that shortcut removes the risk.
Never copy an address from your transaction history. This is the single most important rule. Your history is exactly where the poison lives. Get the address from the source each time: the exchange's deposit page, the recipient directly, or your own saved address book.
Check the whole address, not just the ends. When you do paste an address, verify the middle characters too, or at least a longer run than the first and last four. The attack relies on you checking only the parts it has matched.
Use an address book or allowlist. Save trusted addresses once, verified carefully, and send only from that saved list. Many wallets let you label and store addresses, and some let you allowlist which addresses can receive funds. A saved, verified address cannot be poisoned.
Send a small test transaction first for any large or new transfer. Send a small amount, confirm it arrives at the right place, then send the rest. The cost is a small fee; the protection is complete.
Be suspicious of tiny or unexpected deposits. A small amount of an unknown token, or a zero-value entry you did not initiate, may be bait. Do not interact with it, and do not treat the sending address as trusted.
These habits sit alongside the broader discipline in our guide to verifying what you are signing.
If you have already sent to a poisoned address
Be honest with yourself quickly, because speed occasionally helps.
On a public blockchain, a confirmed transfer cannot be reversed, so funds sent to an attacker's address are usually gone. The exception worth checking immediately: if you sent to what you thought was your own exchange deposit address, contact the exchange at once, because in rare cases funds caught at an exchange can be frozen if reported fast enough. Preserve the transaction hash and details, and report it. Our guide on a compromised wallet covers securing everything else.
And expect a recovery scam afterwards. Anyone promising to reverse an on-chain transfer for a fee is lying; it cannot be done.
Red flags
- A tiny or zero-value transfer appearing in your history unprompted
- A small amount of an unknown token you did not buy
- An address in your history whose ends match a real one but whose middle differs
- Any habit of copying send addresses from past transactions
- Verifying only the first and last few characters before sending
What this guide cannot do
It cannot recover funds already sent to a poisoned address, which on a public blockchain are almost always unrecoverable. What it can do is make you immune going forward, because unlike most scams this one has a complete defence: get the address from its source, check the whole thing, and never copy from history. Ten seconds of discipline closes it entirely.
This is general information, not financial or security advice.
Use Chain Pursuit's free tools to understand your options, preserve evidence, and identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
Cointelegraph, What Are Address Poisoning Attacks in Crypto and How to Avoid Them. https://cointelegraph.com/news/address-poisoning-attacks-in-crypto, source for the mechanics (look-alike addresses, zero-value transfers, transaction-history spoofing, dusting), the figure of over 83 million dollars in confirmed losses, the May 2025 2.6 million dollar case, the May 2024 68 million dollar WBTC case, the Chainalysis finding of over 82,000 linked wallets, and the recommended defences.
Chainalysis, Crypto Crime and Address Poisoning Research. https://www.chainalysis.com/blog/, blockchain analysis of address-poisoning campaigns and the scale of wallets targeted.
The irreversibility of confirmed on-chain transfers is a property of public blockchains, which is why prevention is the only reliable protection here. Figures are as reported; reviewed quarterly.
Frequently asked questions
What is address poisoning in simple terms?
An attacker sends you a transaction from a wallet address crafted to look like one you use, matching the first and last characters. It sits in your transaction history so that later, when you copy an address from history to send funds, you grab theirs by mistake and the money goes to them.
Why is a zero-value or tiny transfer dangerous?
It is the bait. A zero-value transfer can appear in your history without your signature and is easy to overlook, and a tiny token transfer does the same. Its only job is to plant a look-alike address in your history where you might copy it later.
How do I avoid it?
Never copy a send address from your transaction history, since that is exactly where the poison lives. Get the address from its source each time, use a saved and verified address book, check the whole address rather than just the ends, and send a small test transaction before any large transfer.
Isn't checking the first and last few characters enough?
No, and that assumption is the whole vulnerability. Attackers specifically generate addresses that match the first and last characters you glance at, while the middle, which you do not check, is theirs. Verify a longer run of the address, or avoid the risk entirely with a saved address book.
How much has address poisoning cost people?
Confirmed losses exceed 83 million dollars. Individual cases include a 2.6 million dollar USDT loss in May 2025 and around 68 million dollars in wrapped Bitcoin in May 2024. Analysts have tied a single campaign to more than 82,000 wallets, focused on high-balance users.
Can I get my funds back if I sent to a poisoned address?
Usually not, because a confirmed transfer on a public blockchain cannot be reversed. The one exception worth trying immediately is if you sent to what you believed was your own exchange deposit address, contact the exchange at once, since funds can occasionally be frozen there if reported fast enough.
Someone sent me an unknown token. Should I do anything with it?
No. Do not interact with it, do not try to sell or move it, and do not treat the sending address as trusted. Unexpected tokens and dust are often bait for address poisoning or for malicious approval prompts. Leave it alone.
A service offered to reverse the transaction for a fee. Is that real?
No. On-chain transfers cannot be reversed, so anyone promising to undo one for a fee is running a recovery scam. Never pay an upfront fee. Report the original loss through official channels instead.
Sent funds to the wrong address?
Eleven questions on what can be done and how to report it.
Check my case