Short answer
In address poisoning, the attacker creates an address whose first and last characters match one you often use and sends you a tiny or zero-value transfer from it, so it appears in your history. If you later copy the address from that history, you pay the attacker. A USENIX Security 2025 study counted 270 million such attacks on Ethereum and BSC.
Who this is for: Crypto users, treasury managers and teams that publish payment addresses.
How it works
- The attacker watches the chain for transfers between a victim and an address the victim uses often.
- They generate a lookalike address with the same first and last characters as the real one. If the real address starts with
0x7a3fand ends with91c2, so does the fake; only the middle differs. - They send the victim a tiny transfer, a zero-value token transfer or a fake token from the lookalike, so it appears in the victim's history.
- Next time the victim copies "the usual address" from their history, they copy the attacker's.
Wallets and explorers often shorten addresses to the first and last few characters, which is exactly the part the attacker matches.
How common it is
| Measure | Value |
|---|---|
| On-chain poisoning attacks | 270 million |
| Targeted victims | 17 million |
| Incidents with losses | 6,633 |
| Losses | At least USD 83.8 million |
The largest known case: on May 3, 2024 a user sent 1,155 wrapped bitcoin, about USD 68 million at the time, to a poisoned address. Most of it was returned after negotiation, which is rare.
How to avoid it
- Copy addresses from your wallet's address book or a trusted source, never from transaction history.
- Compare the whole address, or at least the middle characters, before sending.
- Hide zero-value and unknown token transfers in your wallet or explorer if it offers that option.
- Send a small test amount first for a large transfer, and confirm it arrived.
What project teams can do
Treasury and payout wallets are frequent targets, because they send many transfers to the same addresses. Keep payout addresses in a shared, reviewed list. Publish your project's official contract and wallet addresses in one place, such as your official links page, so users can compare the full address before they send.
Sources
- USENIX Security 2025: address poisoning study
- Chainalysis: address poisoning scam
- CoinDesk, May 3, 2024
- The Block, May 11, 2024
Frequently asked questions
Does address poisoning need my signature?
No. The attacker only sends you a transaction. Losses happen when you send funds to the copied address yourself.
How do I avoid it?
Copy addresses from your own address book or a trusted source, never from transaction history, and compare the whole address, not just the start and end. Send a small test amount first for large transfers.