Address poisoning is a scam that exploits how humans handle cryptocurrency addresses. Unlike hacks that target smart contracts or exchanges, this attack targets users themselves—specifically, the way we copy and paste long, random-looking strings without actually reading them. The scam has cost users millions, and it’s getting harder to spot.
What is Address Poisoning in Crypto?
Address poisoning is a scam where attackers send a small amount of crypto to a victim’s wallet from an address that looks almost exactly like either the victim’s own address or an address they’ve used before. The attacker is hoping the victim will copy this similar-looking address from their transaction history later when sending funds, accidentally sending crypto to the attacker instead of the intended recipient.
The attack works because blockchain transactions are permanent and publicly visible. Attackers watch addresses, find patterns, and create poisoned addresses that match most of the characters of legitimate ones. The amounts are tiny—often less than a dollar—because the attacker’s goal isn’t the transfer itself but getting their address into the victim’s records. Once the victim sends funds by copying from their history, the malicious address replaces the correct one, and the money is gone. Blockchain transactions are irreversible. There’s no bank to call and no way to get it back.
The attack works because users rarely check incoming transactions carefully. Most people check the sender’s address only when expecting a payment, and even then, they focus on the amount. Attackers rely on this habit, adding entries to transaction histories that look legitimate at a glance.
How Address Poisoning Attacks Work
The mechanics involve several deliberate steps, each exploiting a specific weakness in how users handle cryptocurrency addresses.
First, the attacker picks a target. They might choose a specific person known to hold significant crypto, or they might target addresses associated with exchanges, DeFi protocols, or popular wallets. They use blockchain analysis tools to find addresses that frequently transact with other addresses.
Next, the attacker generates a deceptive address. Modern address poisoning uses addresses that share the first four to six characters and the last four to six characters with the legitimate address—the portions users actually verify. Ethereum addresses start with “0x” followed by 40 hexadecimal characters. Bitcoin addresses range from 26 to 35 characters depending on format. The attacker generates thousands or millions of addresses until they find one that closely matches a high-value target.
The attacker then sends a tiny amount from the poisoned address to the victim’s wallet. The amount is small because the attacker’s goal is the address placement, not the transfer value.
Finally, the attack executes when the victim sends funds. The next time the victim needs to send crypto, they open their wallet, navigate to transaction history, and copy an address from a past transaction. Without checking the full address, they paste it into the send field. The transaction goes to the attacker’s address instead. By the time the victim realizes the error, the blockchain has confirmed the transfer. Recovery is almost impossible.
Types of Address Poisoning Attacks
Address poisoning comes in several forms, each exploiting different aspects of how users handle cryptocurrency addresses.
Typosquatting Addresses
Typosquatting creates addresses that differ from legitimate addresses by only one or two characters. This technique predates cryptocurrency—it was used in domain name spoofing—but applies directly to blockchain addresses where users must manually enter or verify strings. An attacker might register an address that differs from a popular token contract address by swapping similar-looking characters: the number “0” for the letter “O,” or lowercase “l” for uppercase “I.” Given the length of most cryptocurrency addresses, these subtle differences often go unnoticed.
Clipboard Hijacking
Clipboard hijacking is a more technical attack where malware intercepts the user’s clipboard content. When a user copies what they believe is a legitimate address, the malware silently replaces it with the attacker’s address before the user pastes it into their wallet. This attack is dangerous because it works regardless of how carefully the user verified the original address. The user copies the correct address, but what gets pasted is different. Clipboard hijacking often operates alongside other malware and may be delivered through phishing campaigns, malicious downloads, or compromised websites.
Transaction History Poisoning
This is the most common form of address poisoning. Attackers deliberately send tiny amounts from addresses designed to match recipients in a victim’s history. The victim, remembering a successful transaction to that recipient, copies from history without verification. The matching prefix and suffix—the parts users actually check—create false confidence.
DNS Hijacking Combined with Address Poisoning
More sophisticated attackers combine address poisoning with DNS hijacking. They compromise a cryptocurrency-related website and replace legitimate addresses displayed on the site with poisoned addresses. Users visiting the site to obtain deposit addresses instead receive the attacker’s addresses. When they send funds, they go directly to the attacker. This variant is especially dangerous because it targets users at the moment they are actively preparing to transact, when they may be most attentive—except the attention is misdirected.
Real Examples of Address Poisoning
Address poisoning has caused documented losses across multiple blockchain ecosystems, though precise figures are hard to pin down because many victims don’t report incidents or realize what happened.
Ethereum and ERC-20 token transfers have been heavily targeted. Attackers have created addresses that match the first six and last four characters of popular token addresses like USDT, USDC, and Wrapped Ether. Transaction monitoring shows continuous small deposits to thousands of wallets, systematically poisoning address histories across the network. Security researchers have documented campaigns where attackers sent as little as $0 in various tokens to establish poisoned entries.
Bitcoin address poisoning has also emerged as exchanges and institutional custodians have become more prevalent. Attackers target addresses associated with known exchange wallets, understanding that victims frequently send to these addresses for trading or withdrawal. The blockchain’s transparency allows attackers to identify patterns and create matching addresses for specific exchange hot wallets.
One case involved attackers targeting users of a popular DeFi aggregator. The attackers front-ran transactions to identify large transfers, then quickly created matching addresses and sent infinitesimal amounts to poison the sender’s history. The victim, when sending a follow-up transaction days later, copied the attacker’s address instead. The attacker’s profit came not from the tiny initial transfer but from the subsequent large transaction worth thousands of dollars.
How to Detect Address Poisoning Attacks
Detecting address poisoning requires changing how you interact with cryptocurrency addresses—developing habits that assume every address could be compromised until verified.
Never rely solely on copied addresses. Always verify the full address character by character before sending any significant amount. Wallet interfaces typically show only the first four to six and last four to six characters, which is precisely the range attackers manipulate. Expand to view the complete address or use a hardware device that displays the full address on its screen.
Scrutinize incoming transactions carefully. If you receive an unexpected tiny transfer from an address you do not recognize, investigate before responding. Attackers hope you will ignore these small deposits, but they represent reconnaissance—attempts to insert themselves into your transaction history.
Use address whitelisting features that your wallet or exchange provides. Many platforms now allow you to save addresses with custom labels, reducing the need to copy from transaction history. Once an address is whitelisted, any future transaction pulls from that saved entry rather than requiring a copy operation.
Monitor your transaction history for any addresses you do not remember initiating. If you see an incoming transaction from an address with a familiar-looking prefix and suffix but no record of sending to that address, it may represent an attempted poisoning. Mark such addresses clearly in your records to avoid future confusion.
How to Prevent Address Poisoning Attacks
Prevention requires architectural changes to how you handle cryptocurrency transactions—moving beyond user vigilance alone because vigilance fails under fatigue, time pressure, and distraction.
Hardware wallets provide significant protection because they display the full address on the device screen before any transaction is signed. This creates a trustworthy reference point that cannot be compromised by clipboard malware or display manipulation. However, you must verify the address shown on the hardware device matches what you intend to send.
Address book and whitelisting features eliminate the need to copy from transaction history. Instead of pulling addresses from past transactions, you maintain a curated list of verified addresses saved within your wallet software. When sending, you select from this list rather than copying from history. This breaks the attacker’s primary pathway.
Some wallet applications now implement address confirmation features that warn when a recipient address appears in your history but has not been whitelisted or verified. These tools compare incoming addresses against known poisoning patterns and flag suspicious similarities.
Cross-checking through independent channels provides another layer of verification. If sending a significant amount, verify the address through a secondary communication channel—confirm via a separate messaging app or phone call if the recipient is known to you. This assumes the attacker has not compromised multiple channels, which is usually the case for individual attacks.
QR code scanning eliminates clipboard manipulation risks but introduces different vulnerabilities if the QR code itself has been tampered with. Always verify that the QR code was generated by the intended recipient in your presence or obtained through a trusted physical source.
What to Do If You’re a Victim
If you discover you have sent funds to a poisoned address, immediate action is necessary—though expectations should be realistic.
Contact the recipient exchange or wallet provider immediately if you sent to an address associated with a centralized service. Provide the transaction details, the intended recipient, and the mistakenly sent address. Some exchanges maintain monitoring for known poisoning addresses and may freeze funds before withdrawal. Success depends on how quickly you act and whether the attacker has already moved the funds.
Report the incident to relevant authorities. In the United States, the FBI’s Internet Crime Complaint Center (IC3) accepts cryptocurrency fraud reports. Local law enforcement may also assist, particularly for larger amounts. While recovery is rare, reports contribute to aggregate tracking that may assist in broader enforcement actions.
Document everything. Save transaction hashes, wallet addresses involved, timestamps, and all communication related to the incident. This documentation may prove useful for tax purposes, legal proceedings, or if any recovery opportunities emerge.
Accept the likelihood of loss. Blockchain’s immutability means transactions cannot be reversed, and address poisoning relies on this fundamental characteristic. Treat any recovered funds as unexpected rather than expected.
The Future of Address Poisoning Attacks
Address poisoning attacks will continue evolving as the cryptocurrency ecosystem matures and defensive measures improve. Attackers are already leveraging automation to scale their operations—generating thousands of potential poisoning addresses and systematically testing which ones yield profitable returns.
The emergence of account abstraction and smart contract wallets introduces new potential defense mechanisms. Some developers are exploring ways for wallets to validate recipient addresses against historical patterns, warning users when an address appears suspicious or has been flagged in community databases.
Industry-wide address verification standards remain elusive. Unlike email, which adopted standardized authentication mechanisms, cryptocurrency lacks a universal system for proving address ownership. Until such systems emerge—or until user behavior fundamentally changes—address poisoning will remain a profitable attack vector.
The ultimate defense rests on assuming that address poisoning will happen to you eventually. Building systems and habits that render the attack ineffective—through whitelisting, hardware verification, and verification protocols—protects your funds regardless of how sophisticated the attacks become.
