Address poisoning is a crypto scam that tricks you into sending funds to an attacker by planting a lookalike wallet address in your transaction history. The scammer studies the blockchain, finds an address you use often, then generates a fake address that starts and ends with the same characters as yours, since wallets and block explorers typically shorten addresses for display. They send a tiny or zero-value transfer from that fake address to your wallet so it shows up in your recent activity. Later, when you go to send funds and copy an address from your history instead of typing or verifying it in full, you risk grabbing the fake one. No private key is stolen and no malware is required; the scam exploits a simple habit. Losses have reached tens of millions of dollars in single incidents. Protection comes down to checking the complete address character by character before confirming any transfer, not just the first and last few digits.
Anyone who has sent crypto or an NFT more than a few times has probably copied a wallet address from their transaction history instead of retyping it. It’s faster, and it feels safer than typing 42 random characters by hand. Address poisoning exists specifically to turn that habit against you, and it doesn’t require breaking your wallet’s encryption or tricking you into signing anything malicious. It just needs you to grab the wrong address from a list that looks ordinary.
How an address poisoning scam actually works
The attack starts with the attacker watching public blockchain activity, which anyone can do, since every transaction and every address is visible on-chain. They look for wallets that move funds regularly or hold significant balances, then generate new addresses until they find one that shares the same first few and last few characters as the target’s real, frequently used address.
This is computationally easy. Wallet software and block explorers almost always display addresses in a shortened form, something like 0x1E4f...9a2C, to save space. Generating a new address that happens to start with 0x1E4f and end with 9a2C just takes repeated attempts, which a computer can run through quickly. The middle of the address, the part nobody actually checks, is completely different.
Once the attacker has that lookalike address, they send a small or zero-value transaction from it to the target’s wallet. That transaction now appears in the target’s history, sitting right next to transactions involving the real address it imitates. Nothing has been stolen yet. The attacker is just waiting.
The theft happens later, whenever the target needs to send funds to that address again. Instead of typing it out or pulling it from a saved contact, they open their wallet’s recent activity, find what looks like the right entry, and copy it. If they paste it without checking every character, the funds go straight to the attacker instead.
Why it works even though nothing is hacked
What makes address poisoning effective is that it doesn’t trip any of the security measures people normally rely on. There’s no phishing link to click, no fake website asking for a seed phrase, and no suspicious permission request to approve. According to MetaMask’s official guidance on address poisoning scams, the entire attack happens using only information that’s already public on the blockchain, and it never touches your private keys or requires you to sign anything.
That also means standard advice like “never share your seed phrase” or “don’t connect your wallet to unknown sites” doesn’t help here. The target does everything right from a technical security standpoint and still loses funds, because the mistake happens at the much more mundane step of copying an address.
The $68 million case that showed the real stakes
Address poisoning isn’t a theoretical risk. In May 2024, a single victim lost roughly $68 million in wrapped Bitcoin to this exact scam. According to Cointelegraph’s reporting, the attacker had planted a lookalike address in the victim’s transaction history, and the victim later copied that address instead of their intended recipient’s, sending over 1,100 WBTC to the attacker in a single transfer.
The incident is now one of the most cited examples in crypto security writeups precisely because nothing unusual happened from the victim’s side. They weren’t careless by typical standards. They used a wallet with a large balance, moved funds regularly, and made the kind of copy-paste decision almost everyone makes multiple times a week. The only difference was that one entry in their history had been planted there weeks or months earlier, waiting.
Address poisoning vs. other wallet threats
It helps to know how this differs from other scams that get lumped in with it. Clipboard-hijacking malware is a related but separate threat: it’s malicious software on your device that silently swaps whatever address you’ve copied for the attacker’s address the moment you paste it. That requires your device to actually be compromised. Address poisoning requires nothing of the kind; it works purely through social engineering and a cluttered transaction history, which is part of why it’s harder to defend against with antivirus software or browser extensions alone.
It’s also distinct from approval-based drains, where a scam dApp gets you to sign a permission that lets it move tokens out of your wallet later. If you’ve approved a contract you don’t recognize, that’s a separate problem worth checking on its own; see our guide on how to revoke NFT approvals and wallet permissions for how to audit and undo those. Address poisoning doesn’t need any approval at all. It just needs one bad copy-paste.
How to protect yourself
The core defense is simple to state and easy to skip in practice: verify the full address before you send anything, not just the first and last few characters. Expand the address in your wallet or block explorer and compare it in full, or at minimum check several characters in the middle, which is exactly the part a lookalike address gets wrong.
Saved address books and named contacts help more than people expect, since a wallet that shows “Marketplace Payout Wallet” instead of a raw string removes the temptation to eyeball-match shortened hex. Many wallets also let you flag or hide incoming transactions from unknown senders, which keeps poisoned entries from cluttering your recent activity in the first place.
For any transfer involving a meaningful amount, send a small test transaction first and confirm it arrived before sending the rest. This costs a bit of gas but makes a copy-paste mistake cheap instead of catastrophic. It’s also worth getting comfortable reading exactly what you’re approving before signing anything, a habit covered in our guide on how to read a wallet signature request before you sign it, since careful verification habits tend to carry over between these different scam types.
Hardware wallets don’t prevent address poisoning on their own, since the attack happens before the signing step, but showing the destination address on the device’s own screen gives you one more honest checkpoint before a transaction goes through, separate from whatever your computer’s display is showing you.
What to do if you’ve already sent funds to a poisoned address
Once a transaction confirms on-chain, it cannot be reversed. There’s no customer support line to call and no dispute process, since there’s no company in the middle of the transfer. The realistic options are reporting the receiving address to your exchange and to blockchain analytics firms in case the funds move through a centralized platform later, and, if the loss is large enough, reporting it to local law enforcement and a blockchain forensics service. Recovery isn’t common, but a documented report at least creates a paper trail if the funds ever surface somewhere traceable.
Going forward, treat the incident as a reason to rebuild your transaction habits rather than just a one-time loss. Clear out saved contacts you’re not sure about, start using full-address verification by default, and consider moving to a wallet that supports named contacts or address allowlisting.
Frequently asked questions
Is address poisoning the same as a wallet hack?
No. A wallet hack typically means an attacker gained access to your private keys or seed phrase. Address poisoning never touches your keys at all. It relies entirely on tricking you into voluntarily sending funds to the wrong address, using nothing but publicly visible blockchain data.
Can address poisoning affect Bitcoin as well as Ethereum?
Yes. The technique works on any blockchain where addresses are long strings that wallets and explorers display in shortened form, which includes Bitcoin, Ethereum, and most other major chains. The $68 million case involved wrapped Bitcoin on an Ethereum-compatible network, showing the attack isn’t limited to one ecosystem.
Does a hardware wallet protect you from address poisoning?
Not by itself. A hardware wallet protects your private keys from being stolen, but address poisoning doesn’t try to steal keys. It tricks you into choosing the wrong destination address before you ever get to the signing step. Checking the full address on your hardware device’s screen helps as an extra verification step, but the core defense is still reading the address carefully before you send.
Leave a Reply