What crypto address poisoning is
Crypto address poisoning is a social-engineering technique that exploits how people copy wallet addresses. An attacker creates or finds an address that resembles one a victim has used before, then sends a tiny transaction or otherwise causes the lookalike to appear in the victim’s transaction history. Later, the victim may copy an address from that history without checking every character and send a much larger transfer to the attacker instead of the intended recipient.
The attack does not usually break the blockchain’s cryptography or take control of the victim’s wallet. Its leverage is a human shortcut: many addresses are long, users often compare only the first and last characters, and wallet histories make recent destinations convenient to reuse. The scam is most dangerous when a user is about to make a large or repeated transfer and assumes a familiar-looking history entry is trustworthy.
How a lookalike address is created
Attackers can generate addresses that share a chosen prefix and suffix with a target address. They may use automated tools to search for a vanity address that looks similar in the parts a wallet interface displays. The middle characters differ, but users often do not inspect the full string. Because public blockchains expose transaction histories, an attacker may observe a commonly used destination and attempt to plant a lookalike near it.
The planting transaction may be a tiny transfer, a zero-value token event or an unfamiliar asset sent to the victim’s address. The exact method depends on the chain and wallet display. Seeing a transaction in the history does not mean the victim authorized it, and receiving a small amount does not by itself grant the sender control over the wallet. The attacker’s goal is often to make their own similar address easy to copy later.
Why transaction history is not an address book
Transaction history is a record of activity, not a verified contact list. A past recipient may be legitimate, but a new entry can be inserted by anyone who can send a public transaction. Wallet interfaces may show a shortened address, a token symbol or an unfamiliar label. Those display choices help users navigate, but they can obscure the full address and context.
Never select a recipient solely because it appears near the top of recent activity. A poisoning transaction can be designed to match the same opening and closing characters that the interface shows. A token logo or exchange-style label is not proof of identity either. Use a separately verified address source: a recipient’s official deposit page, a saved contact you established yourself, or a trusted address book that you maintain and protect.
How to verify an address before you send
Start from the original source of the address rather than from transaction history. If sending to an exchange, open its official app or type the domain yourself, choose the correct asset and network, and copy the current deposit address. If sending to a person, confirm the address through a separate trusted channel. Do not use a wallet address posted by an unsolicited “support agent” or a comment reply.
Before signing, compare the full address where practical, not only a few characters at each end. Check it on the wallet’s trusted confirmation screen or hardware device if available. Verify the asset, network, amount and any required memo or tag. For a large transfer to a new destination, consider a small test transaction, while understanding that a test has its own cost and does not replace verification of the full transfer. A saved address should have a clear label and should be reviewed periodically.
Some address formats include a checksum, such as mixed-case checks used by many EVM wallets. A checksum can help detect certain typing errors, but it does not prove that an address belongs to the intended person. A generated lookalike may be a valid address with a valid checksum. Similarly, copying and pasting is safer than typing by hand only when the clipboard contains the correct destination. Malware can monitor or alter clipboard contents, so review the address after pasting and again on the wallet’s confirmation screen.
For recurring payments, establish an address book entry through a deliberate verification process. Confirm the address with the recipient using a channel you already trust, then label it with the person or service and the network. If the recipient later sends a “new address” in an urgent email or direct message, verify that change using a second channel, such as a known phone number or previously established contact. Attackers may impersonate both sides of a conversation, so a familiar profile picture or display name is not enough.
Recognizing suspicious entries
Be cautious if a tiny or unknown transaction appears immediately before you plan to send funds to a familiar recipient. Compare its address with the legitimate one you intended to use; do not copy it just because it looks similar. Look for unusual token transfers, zero-value events or unfamiliar “dust” entries in recent activity. If your wallet offers address-poisoning warnings or suspicious-address detection, treat those warnings as helpful signals, not as a substitute for checking the recipient.
An unfamiliar deposit is not always an attack. Tokens can be airdropped without consent, and block explorers may index interactions in unexpected ways. The safe response is not to click links or claim the token. Do not visit a website named after the token, connect your wallet or sign a message to remove it. Hide the asset using the wallet’s built-in display options if available, and keep your normal sending workflow separate from unsolicited token activity.
Dusting and address poisoning are related but not identical
The word “dust” describes a very small amount of cryptocurrency or token. A dusting attack may send tiny amounts to many addresses in an attempt to study activity or encourage users to interact with a malicious token. Address poisoning specifically aims to influence the address a user copies or chooses. Some attacks use a tiny transaction as the planting method, but not every dust transaction is part of an address-poisoning attempt, and the techniques can have different goals.
In either case, receiving a small amount does not mean you should spend it or interact with it. On account-based chains, a token may contain a malicious link or be designed to trigger a wallet prompt. On UTXO-based chains, spending a dust output can have privacy and fee implications. Do not treat unsolicited assets as an invitation. Use trusted wallet documentation to hide or manage them, and avoid signing anything you do not understand.
What to do if you already copied a suspicious address
If you have not signed or broadcast the transaction, stop and replace the recipient with the address obtained from the trusted original source. Recheck the full address on the confirmation screen. If you already broadcast a transaction, copy its hash and verify the recipient in a reputable explorer for the correct network. A pending transaction may have wallet-specific options, but a confirmed transfer generally cannot be reversed by customer support.
If the funds were sent to a lookalike address, contact the exchange or wallet provider through its official support channel if relevant, but be realistic: the network does not identify the person who controls an address, and a third party cannot force a return. Do not pay a recovery service or share your private keys. Report the address to the relevant platform or security service using its official reporting process. Preserve transaction records and beware of follow-up scams claiming they can retrieve the funds.
Wallet and exchange safeguards
Use wallet features that flag lookalike addresses or suspicious transaction history when available. Keep wallet software updated, enable address books or allowlists for frequent recipients, and use withdrawal allowlisting on an exchange if it fits your needs. Some services apply a delay when a new withdrawal address is added; that delay can be a useful security barrier. These protections reduce risk but cannot validate every destination or prevent a user from approving the wrong address.
For organizational wallets, use multi-person approval for large withdrawals and maintain an independently verified beneficiary list. Set a process that requires a second person to compare the address on a trusted device. Do not approve a request because it is urgent or appears to come from a familiar account; verify changes using a separate communication channel. Hardware wallets help protect keys, but users still need to verify recipient details on the device screen.
A safer routine for addresses you use repeatedly
Repeated transfers create a temptation to reuse the most recent transaction from history. Instead, establish a verified contact or allowlisted withdrawal address after checking it through a trusted source. Label it with both the recipient and network. If the recipient changes an address, verify the change through a second communication channel that you already trust; do not rely on a new email, social post or chat message by itself. A familiar display name can be copied, and an account can be compromised.
For a hardware wallet, compare the full destination shown on the device with the address from the verified source. The device protects the signing key, but it cannot determine whether the address belongs to your intended recipient. For an exchange withdrawal, allowlisting and any security delay can add a useful checkpoint. For a large transfer, consider sending a small test first, then retrieve the full destination again from its original source rather than copying the test transaction from history.
If your wallet detects a lookalike or unknown destination, pause and compare every character. A checksum can catch some typing mistakes, but a valid checksum does not identify the owner of an address. Keep your own address records in a protected location and review them when the recipient’s network or platform changes.
Frequently asked questions
Can a dust transaction hack my wallet?
Receiving a small transaction alone does not usually give the sender control of your wallet. The risk is interacting with an unknown token or copying a lookalike address from history. Do not click associated links or sign unfamiliar requests.
How do I know if a wallet address is poisoned?
Compare the full address with the one from a trusted original source. A similar prefix and suffix are not enough. Look for tiny or unexpected history entries and use wallet warnings as an additional signal.
Can I reverse a transfer sent to a poisoned address?
A confirmed blockchain transfer is generally irreversible. Contact a custodial service only through official support if it controls the recipient account. Avoid anyone who promises recovery in exchange for an upfront payment or your seed phrase.
Sources and further reading
MetaMask: address poisoning scams · Kraken: dusting attacks · Kraken: dusting attack guidance · Ethereum.org: security and scam prevention
Comments
Loading comments…