Address Poisoning: How the Crypto Scam Works and How to Stop It

Address poisoning is a crypto scam in which an attacker plants a look-alike wallet address in your transaction history, hoping you will copy it and send funds to them by mistake. The fake address shares the first and last few characters with one you really use, and it usually arrives as a zero-value or tiny transfer minutes after a genuine transaction. No hacking of your wallet is involved: you sign the losing transaction yourself.

It sounds crude, but it works at scale. A peer-reviewed study counted about 270 million poisoning attempts on two chains in two years, and single victims have lost $50 million or more. This guide explains how the attack works, the main variants, the largest known cases, and the habits that stop it.

How an address poisoning attack works

The attack exploits one human shortcut: people check the start and end of an address and skip the middle. Crypto addresses are long. An Ethereum address is 40 hexadecimal characters after the 0x, and a Sui address is a 32-byte identifier written as 64 hex characters. As one of the CMU researchers behind the largest study put it, wallet addresses "are long, hexadecimal strings that are impossible to remember" (CMU CyLab, January 2026).

A typical attack runs like this:

1. The attacker watches the chain. Bots monitor transfers, often of stablecoins, between a victim and a regular counterparty such as an exchange deposit address.
2. They generate a look-alike. Software brute-forces a new address whose opening and closing characters match the counterparty's. The USENIX study found one sophisticated group appeared to use GPUs for this, while others relied on CPUs.
3. They plant it in your history. The attacker sends a transaction that links your address to the look-alike, usually within minutes. The researchers found poisoning transfers arrive "mostly within 20 minutes" of the original transfer.
4. You copy the wrong address. Next time you pay that counterparty, you open your wallet or a block explorer, see what looks like the familiar address at the top of your history, copy it, and send.

Because the transfer is valid and on-chain, it cannot be reversed. That is the whole business model.

The three main variants

The USENIX Security 2025 paper "Blockchain Address Poisoning" by Taro Tsuchiya and Nicolas Christin, and Etherscan's guidance, describe three common forms.

Zero-value transfers

The attacker records a transfer of zero tokens from your address to the look-alike. In many popular ERC-20 implementations, the public transferFrom function lets anyone name an arbitrary sender when the amount is zero, the paper explains. The result is a history entry that makes it look as if you sent money to the attacker before. The paper calls this potentially more dangerous than other variants, because the look-alike appears as a past recipient you chose.

Tiny ("dust") transfers

The look-alike address sends you a very small amount of a token you use, so it appears in your incoming history. Etherscan treats transfers below $0.01 of USDT, USDC or DAI, or below 0.00001 ETH, as dust, while noting that some dust transfers are legitimate.

Counterfeit token transfers

The attacker deploys a fake token and moves it between your address and the look-alike, often mirroring the exact amount you just sent. Because ERC-20 tokens have no restrictions on names or symbols, the fake can look close to the real thing, the paper notes.

How big is the problem?

The USENIX study, covering Ethereum and BNB Smart Chain from 1 July 2022 to 30 June 2024, found about 270 million poisoning attempts aimed at roughly 17 million victims. It confirmed 6,633 successful incidents with losses of at least $83.8 million, and its count of attacks is 13 times larger than earlier estimates (CMU CyLab).

Success is rare, around 0.01% of attempts on Ethereum by the paper's measure, but attacks are cheap to automate. "It's a numbers game," co-author Nicolas Christin said, and CMU reports that some organised groups earn 10 to 20 times what they spend on fees and infrastructure.

The researchers say real losses are probably higher, since many victims never report. The $83.8 million total also excludes the two largest single cases below: the paper observed the WBTC transfer but did not count it as a confirmed loss, and the USDT case came later.

Notable address poisoning losses

1,155 WBTC, May 2024 (about $68 million)

In early May 2024 a victim sent 1,155 wrapped bitcoin, then worth about $68 million, to a poisoned look-alike address. After on-chain negotiations, in which the victim offered to let the attacker keep 10%, the attacker began returning funds on 10 May 2024 and sent back about 22,960 ETH worth $65.7 million, more than 96% of the original dollar value, Cointelegraph reported. A return like this is the exception. For more on the token involved, see what is wrapped bitcoin (WBTC).

49,999,950 USDT, December 2025 (about $50 million)

In December 2025 a victim sent 49,999,950 USDT after copying a malicious address from their transaction history, Cointelegraph reported on 20 December 2025. The victim had first sent a small test transaction to the correct address. The attacker then poisoned the history, and the full amount went to the look-alike minutes later. The stolen USDT was swapped for ether, split across wallets and partly moved into Tornado Cash.

Why a test transaction does not protect you

The December 2025 case shows a common misunderstanding. A test transaction proves that the address you used for the test works. It says nothing about the address you paste next.

The test can actually make things worse. It creates the very on-chain event that poisoning bots react to, and it puts a fresh entry at the top of your history right before you go back to copy the address for the main transfer. If you test, paste the second address from the same trusted source you used the first time, never from your history, and check every character again.

How to protect yourself from address poisoning

• Never copy addresses from your transaction history. MetaMask's own guidance says the same. Copy from the original source, such as the exchange's deposit page.
• Use your wallet's address book. Save addresses you have verified once, and send only to saved contacts.
• Check the whole address, especially the middle. Attackers match the ends, so the middle characters are where the difference shows. Compare in chunks.
• Confirm on a hardware wallet screen. A hardware wallet typically makes you confirm the destination on the device itself, which gives you a second, independent look before signing. See hot wallet vs cold wallet.
• Heed wallet warnings. MetaMask says it now detects when a destination closely resembles an address you have used before, for example matching the first four and last four characters, and shows a blocking warning. It also warns when you send to an address for the first time.
• Ignore unexpected zero-value or tiny transfers. Do not interact with them or with unknown tokens. Etherscan hides zero-value transfers by default and shows a pop-up when you copy an address linked to suspicious activity.
• Use names where they are supported. Human-readable names, such as ENS on Ethereum or SuiNS on Sui, reduce copy-paste errors, though you should still confirm the name resolves to the right address.

None of this is specific to one chain. MultiversX addresses, for example, are bech32-encoded public keys beginning with erd1, and the same full-address check applies. Whether you are moving EGLD to stake for JWLEGLD or SUI to stake for JWLSUI, verify the destination before you sign.

What to do if you have sent funds to a poisoned address

Act quickly, but assume the funds are gone unless something unusual happens.

1. Record everything. Save the transaction hash, the attacker's address and the time.
2. Contact the token issuer and any exchange involved. Some stablecoin issuers can freeze tokens held at a specific address, so speed matters.
3. Report it to the police and your national fraud reporting service. Reports help investigators link wallets.
4. Beware recovery offers. Victims of large public losses are targeted by fake "fund recovery" services. Read our guide to crypto recovery scams before paying anyone.

Your wallet itself is not compromised by poisoning, so you do not need a new seed phrase. If you signed a token approval or connected to an unknown site, that is a different attack: see wallet drainers and approval phishing.

Frequently asked questions

What is an address poisoning attack?

It is a scam where an attacker sends a zero-value, tiny or fake-token transfer so that a look-alike address appears in your transaction history. If you later copy that address instead of the real one, your funds go to the attacker.

Can address poisoning steal funds without my signature?

No. The poisoning transfer cannot move your tokens. Losses happen only when you sign a transfer to the look-alike address yourself, which is why checking the full address prevents the attack.

Why did I receive a zero-value transfer from my own address?

Some ERC-20 tokens let anyone record a zero-amount transfer with an arbitrary sender. Attackers use this to make it look as if you sent funds to their look-alike address. Ignore it and never copy addresses from it.

Is a test transaction enough to avoid address poisoning?

No. A test only proves the address you used for the test. In a December 2025 case, a victim sent a test, then copied a poisoned address from their history and lost nearly $50 million in USDT.

How much has been lost to address poisoning?

A USENIX Security 2025 study confirmed at least $83.8 million in losses on Ethereum and BNB Smart Chain between July 2022 and June 2024. Single cases include a $68 million WBTC loss in 2024, mostly returned, and a $50 million USDT loss in 2025.

Can I get my crypto back after address poisoning?

Usually not, because blockchain transfers are final. Contact the token issuer and any exchange quickly and report to the police, but be wary of anyone offering paid recovery services.

Keep reading

• Wallet drainers and approval phishing
• Fake wallet scams in 2026
• Crypto scams in 2026
• What is a seed phrase?
• Smart contract audits explained

This article is educational and is not financial or legal advice. Figures and case details are as of 17 October 2026 and come from the research and reporting linked above; wallet features change over time.