Address poisoning: how the scam works and how to avoid it
Address poisoning plants a lookalike address in your wallet history and waits for you to copy it. Here is how the attack works, why it fools experienced users, and five habits that stop it.
By Web3 Copilot team4 min read
Address poisoning is a scam where an attacker creates an address that looks like one you have used before, then makes it appear in your transaction history. The next time you copy a "recent" address from that history, you copy theirs. Nothing is hacked. The victim sends the funds themselves.
It works because of a habit almost everyone has: copying an address from the last transaction instead of from the original source, and checking only the first and last few characters.
How the attack works
- The attacker watches the chain. Bots look for wallets that move meaningful amounts, often stablecoins, to a regular counterparty.
- They generate a lookalike. Using vanity-address tools, they create an address that starts and ends with the same characters as your counterparty's. This is cheap: matching a handful of characters at each end takes minutes on an ordinary computer.
- They poison your history. The attacker sends a transaction that links your wallet to the lookalike. Common versions are a tiny real transfer, a transfer of a fake token with a familiar name and symbol, or a zero-value token transfer that shows up as coming from your own address.
- They wait. Next time you want to pay your usual counterparty, you open your history, see an address that looks right, copy it and send.
Why it fools careful people
Wallet interfaces shorten addresses to something like 0x4C9a…a7F3 to save space. That is the exact part the attacker matched. The poisoned transaction also sits right next to your genuine ones, with a familiar token symbol, so it looks like part of your own activity.
The amounts can be enormous. In May 2024 one victim sent 1,155 wrapped bitcoin, worth about $68 million at the time, to a poisoned address. That attacker returned most of the funds days later, which is very unusual. In most cases the money is gone.
Five habits that stop it
Never copy addresses from your transaction history
Treat your history as untrusted. Get the address from the recipient's own source every time, or from an address book entry you created yourself after verifying it.
Save trusted addresses in an address book
Most wallets and exchanges let you save named addresses. Some exchanges can also restrict withdrawals to a whitelist. Once an address is saved and verified, pick it by name instead of pasting.
Compare the middle, not just the ends
If you must compare by eye, check a block of characters in the middle as well. The attacker can match the ends cheaply. Matching the whole address is practically impossible.
Ignore transactions you did not expect
Zero-value transfers, tiny deposits from strangers and tokens you never bought are often bait. Do not interact with them, do not try to "sell" an unknown token, and do not copy addresses from them.
Check the address before large transfers
Before sending a meaningful amount, open the address in an analyzer. A lookalike created for poisoning usually has a short, strange history: it was funded recently and its main activity is sending dust to many wallets. That pattern is a red flag. Our step-by-step guide covers the full routine.
Where Web3 Copilot helps
When you paste an address into Web3 Copilot, the report shows the full address, the network, and a Risk Score with the reasons behind it, along with sanctions results by source. When there is too little data for a fair score, the report says "Limited assessment" instead of showing a number, so a fresh address does not look clean just because nothing is known about it yet.
The extension also lets you save wallets you trust under your own names. Saved wallets stay in your browser, and reopening a saved wallet is a safer habit than copying from history.
If you already sent funds to a poisoned address
Act quickly, even though recovery is rare:
- Report the address to the exchange or service the funds move to next. Some exchanges freeze funds that arrive from reported theft.
- Report to the police and, in the U.S., to the FBI's Internet Crime Complaint Center (IC3).
- Be wary of "recovery services" that contact you and ask for an upfront fee. They are a common second scam.
Poisoning is one of several tricks aimed at stablecoin users. See also how to check if a crypto address is a scam and how the flash USDT scam works.