What Is Address Poisoning? How Lookalike Wallet Addresses Steal Crypto

Most people do not type out a crypto address. It is a long string of letters and numbers, so the usual habit is to copy it from somewhere, often your own wallet's transaction history.

Address poisoning is a scam built around that habit. The attacker does not hack your wallet or steal your keys. They plant a fake address in your history that looks almost exactly like one you trust, and wait for you to copy the wrong one.

Here is how the trick works, why it has caught even very large holders, and the simple checks that make it fail.

What is address poisoning in crypto?

Address poisoning is a scam in which an attacker creates a wallet address that resembles one you regularly send funds to, then makes that address appear in your transaction history.

The fake address usually matches the first few and last few characters of the real one. Many wallets and explorers shorten addresses to something like 0xBaF…f8b5, so the two can look identical at a glance.

If you later copy the recipient from your history instead of from a trusted source, you may paste the scammer wallet address and send your funds straight to the attacker. Because blockchain transfers cannot be reversed, that money is usually gone.

You may also see it called wallet poisoning or transaction history poisoning. The names all describe the same idea: contaminating the list of addresses you trust.

How an address poisoning attack works

The attack follows a fairly consistent pattern.

Watching for activity. Automated bots monitor busy chains such as Ethereum and BNB Smart Chain for token transfers, especially stablecoins like USDT and USDC. A fresh transfer tells them who you pay and roughly how much.

Generating a lookalike. The bot then searches for a new address whose opening and closing characters match your real recipient. This takes raw computing power, and it is the same brute-force approach used to make vanity addresses.

Poisoning the history. Next, the attacker creates a transaction between your wallet and the lookalike, so it shows up in your recent activity right next to the genuine payment.

Waiting. Most of the time nothing happens. The scheme only needs a small share of targets to copy the wrong address once.

The whole process can be quick. In both of the large cases described below, the poisoned entry landed within minutes of the victim's small test payment.

The three ways attackers plant a fake address

A 2025 study by researchers at Carnegie Mellon University, presented at the USENIX Security Symposium, described three main forms of the attack.

Tiny transfers. The attacker sends you a very small amount of the same token you just used, from the lookalike address. It sits in your history as an incoming payment, much like the dust used in dusting attacks.

Zero-value transfers. This version is more convincing. Many ERC-20 tokens let anyone call the transferFrom function for an amount of zero, naming any sender and receiver. The attacker uses this to record a 0-token transfer from your wallet to their lookalike, so it appears that you sent money to that address before.

Counterfeit token transfers. The attacker creates their own token with a name close to a real one and records a transfer of it from your wallet to the lookalike, often for the same amount you really sent. Because they wrote the token contract, they can make it move on anyone's behalf.

None of these let the attacker take anything from your wallet. Your keys and balance are untouched. The danger only arrives if you send funds to the fake address yourself.

How big the problem is

The same research team scanned Ethereum and BNB Smart Chain from July 2022 to June 2024. They found more than 270 million poisoning attempts aimed at over 17 million victim addresses.

Only a tiny fraction worked, but those that did added up. The researchers counted 6,633 successful transfers totalling at least $83.8 million, which makes address poisoning one of the largest crypto phishing schemes observed so far.

Individual cases show how costly a single mistake can be.

In May 2024, a holder sent 1,155 wrapped bitcoin, worth about $68 million at the time, to a lookalike address. According to Chainalysis, the real and fake addresses shared the same first characters, 0xd9A1. After a week of on-chain messages and an investigation, the attacker returned roughly 22,960 ETH, an unusual ending for this kind of theft.

In December 2025, another user sent a test payment of about $50 in USDT to the right address. Minutes later, a poisoned entry appeared in their history, and they sent 49,999,950 USDT to an address that matched only the first three and last four characters. Reports from Web3 Antivirus, Cointelegraph and CoinDesk said the attacker swapped the stablecoins and moved part of the proceeds through Tornado Cash.

Why test transactions do not protect you

Sending a small test amount first is good practice. It confirms that the address is valid and that the recipient can actually receive the funds.

But a test only proves that the address you used for the test was right. If you copy the address again for the main transfer, and copy it from your history, you can still pick up the poisoned entry that arrived in between.

That is exactly what happened in the December 2025 case. The test transaction itself became the trigger that told the bot when to strike.

How to spot a poisoned address

There are a few signs worth watching for in your wallet or on a block explorer.

• Transfers of zero tokens that you do not remember making.
• Tiny incoming payments from addresses that look familiar but that you never contacted.
• Tokens with odd names, or names close to well-known stablecoins, that appeared without explanation.
• Two entries close together in time whose addresses share the same start and end.

Some explorers and wallets now hide zero-value transfers by default or mark suspicious tokens. These filters help, but they do not catch every case, so treat them as a backstop rather than protection.

How to protect yourself from address poisoning

The defences are simple. The hard part is using them every time.

Never copy recipients from transaction history. Take the address from a trusted source instead: the exchange's deposit page, a message you verified with the recipient, or a saved entry you checked carefully when you created it.

Use an address book or allowlist. Most wallets let you save known addresses with a label. Exchanges often let you restrict withdrawals to approved addresses. Once a contact is saved, you no longer need to copy anything from your history.

Check the whole address. Comparing the first and last four characters is exactly what attackers plan for. Read the middle section as well, or compare it in chunks.

Confirm on a separate screen. A hardware wallet shows the full destination on its own display before you sign. Comparing that screen with your trusted copy is one of the strongest checks you can make.

Copy again for the main transfer from the trusted source. After a test payment, return to the original source, not to the test transaction listed in your history.

Consider human-readable names carefully. Services such as ENS on Ethereum map a name to an address. They reduce copy-paste mistakes, but you still need to confirm that the name points where you expect.

What to do if you think you were targeted

If you notice poisoned entries but have not sent anything, your funds are safe. You do not need to move them or interact with the fake tokens, and you should not click any links attached to them. Hiding or ignoring the entries is enough.

If you have already sent funds to a lookalike address, act quickly. Report it to the exchange or wallet you used, and to the stablecoin issuer if the funds were USDT or USDC, since issuers can sometimes freeze tokens before they are swapped away.

Keep the transaction hashes and file a report with your local police or cybercrime authority. Be wary of anyone who contacts you offering to recover the money for a fee, as recovery scams often target people who have just lost funds.

The bottom line

Address poisoning works because crypto addresses are hard to read and easy to copy. The attacker never touches your wallet; they simply count on one rushed moment.

Treat your transaction history as a record of what happened, not as a contact list. Save the addresses you use, check every character that matters, and confirm large transfers on a screen you trust.