Address poisoning is a theft that requires no malware, no phishing site and no access to your wallet. The attacker simply puts a lookalike address into your transaction history and waits for you to copy the wrong one.
It works because of two ordinary habits: wallets display addresses truncated to the first and last few characters, and people copy addresses from their own history rather than retyping them.
How the attack runs
- The attacker watches the chain for wallets making regular transfers — someone topping up an exchange deposit address, say.
- They generate a vanity address that matches the first four or five and last four or five characters of an address you send to often. The middle is entirely different, but the middle is what nobody reads.
- They send you something worthless from it: a dust amount, a zero-value token transfer, or a fake token. It costs them almost nothing.
- That transaction now sits in your history, displayed as
0x71C7…9A2B— identical, at a glance, to the address you actually use. - Next time you transfer, you copy from history, paste, and send to the attacker.
There is no reversing it. The funds are gone the moment the transaction confirms.
The variants worth recognising
- Dust transfers. A tiny real amount sent to you purely to appear in your history.
- Zero-value token transfers. Some token standards allow a transfer of zero to be recorded without your involvement. It appears as though you interacted with that address.
- Fake token contracts. A contract that emits a transfer event you never made, showing what looks like a payment from an address of the attacker’s choosing — often a spoofed version of one you trust.
- Lookalike stablecoins. A worthless token named identically to a real one, so the history entry looks like a genuine transfer of value.
All four do the same job: put a plausible, wrong address in front of you at the moment you are about to copy one.
Defending against it
Never copy an address from transaction history. This one habit removes the entire attack. History is attacker-writable — anyone can put an entry there. Treat it as untrusted input, because that is exactly what it is.
Use a saved address book. Save destinations you use repeatedly, verify them once, carefully, and thereafter select rather than copy. Most wallets and exchanges support this and almost nobody uses it.
Check the middle, not just the ends. Vanity generation makes matching the first and last characters cheap. Matching a run in the middle as well is dramatically harder. If you verify four characters from the centre in addition to the ends, the attack stops being economic.
Verify on your hardware wallet’s screen. The device shows the address actually being signed, and it cannot be altered by anything on your computer. This is the screen’s whole purpose — and it only helps if you read it.
Send a test transaction for large transfers. A small amount first, confirm it arrives where you intended, then send the rest. The fee is trivial insurance against a total loss.
If you receive a suspicious dust transaction
- Do not interact with it. Do not send it back, do not try to spend it, do not visit any URL in a token name or memo.
- Do not panic. Receiving something does not compromise your wallet. Anyone can send anything to any address; it grants them nothing.
- Hide or mark the token if your wallet allows, so it stops appearing beside real entries.
- Treat it as a warning. It means somebody has flagged your address as active and worth targeting. Review your habits, particularly where you copy addresses from.
One thing it is not: a reason to move funds urgently. Attackers sometimes follow poisoning with a message warning that your wallet is compromised and offering help — which is the actual attack, with the dust as the setup.
Why this attack persists
It is cheap, it is passive, and it exploits an interface decision rather than a flaw. Truncated addresses exist because full ones are unreadable, and that abbreviation is precisely the weakness. Until wallets verify addresses against a trusted contact list by default, the burden sits with the person clicking send.
Which reduces to a habit worth building: the address you paste should come from a source you control — a saved contact, a freshly generated deposit address, or a QR code you just scanned. Never from a list anybody can write to.