Wallet security, explained simply
Address Poisoning: How Fake Wallet Addresses Get Into Your Transaction History
A scammer doesn't require your seed phrase or private key. Just one lookalike address in your transaction history can be enough if you later copy it without checking the full recipient address.
Quick answer
What is address poisoning?
Address poisoning is a crypto scam where a fake, similar-looking address is inserted into your wallet or explorer history. This entry can't control your wallet, but the risk arises if you copy it and approve a new transfer to that address.
If you see an unknown zero-value or dust transfer, it doesn't mean your wallet has been compromised. Don't interact with it or use its address for future transfers.
Contents
3 May 2024 · Ethereum
$68 million was sent to the wrong wallet—before being returned
According to Chainalysis, the initial small transfer to the correct address was probably a test. Just minutes later, the wallet sent around 1,155 WBTC to another address that, when shortened, appeared nearly identical. This second address was controlled by the scammer.
The victim signed for the wrong recipient. Ethereum processed the transaction as instructed. The scammer later returned the original $68 million on 9 May after the victim sent public on-chain messages, but this unusual recovery doesn't make such transfers reversible or safe.
The funds were returned in ETH instead of the original WBTC. Chainalysis estimates the scammer retained approximately $3 million due to the asset's price increase.
A test transfer is only effective if you reuse the confirmed recipient from a trusted source. If you copy a new lookalike from your history, the main payment can still be misdirected.
The attack chain
How address poisoning works, step by step
The attack focuses on the moment you select a recipient. It doesn't need to break your wallet's cryptography.
- 01
A genuine payment is recorded publicly
The victim sends crypto to a genuine recipient. Both addresses are recorded publicly on the blockchain.
- 02
The recipient pattern is observed
A scammer monitors public transactions and spots an address the victim might reuse.
- 03
A similar-looking address is created
The fake address shares visible characters with the real recipient but is controlled by the scammer.
- 04
A deceptive entry appears in your history
A zero-value, dust, or token transfer causes the lookalike address to show up in your wallet or explorer.
- 05
The wrong address is copied
Later, the victim chooses the familiar-looking entry instead of going back to a trusted source.
- 06
A legitimate transaction is sent to the scammer
The victim signs the transfer. The blockchain sends the funds to the address that was approved.
The visual trap
The start and end may match, but the address can still be different
Wallets often shorten long addresses to save space, but this can hide the precise part a scammer has altered.
0x91A4b7C2e6F1930DABCD8a45B6cE19fA003172F80x91A4f3D8c4E7192BCAFE6a90C1dE48B700A972F8What a shortened history might display
0x91A4…72F8
0x91A4…72F8Why it appears in your wallet
Public history can include entries you never requested
Public blockchains allow anyone to view addresses and send permitted transactions or tokens. Your wallet may display this activity even if you never approved it.
Zero-value transfer
A token event with no real value can still show up as a visible entry in some wallets or explorers.
Dust transfer
A tiny amount is sent so the lookalike address appears in your transaction history.
Spoofed token activity
A worthless or misleading token can mimic the name or amount of a previous transfer, making the entry seem familiar.
Copied transaction details
The poisoning entry might copy a previous amount or timing pattern to look like a genuine transaction.
You can't erase a confirmed public blockchain record. Some wallets can hide or blur suspicious entries, but the entry itself can't spend your funds.
No. Don't reply, send dust back, click token links, or copy the sender's address. Ignore the entry and always verify future recipients independently.
Know what was targeted
Address poisoning is not a blockchain or private key breach
The transaction is valid because the owner approves it. The trick occurs before signing, when the fake recipient is mistaken for the real one.
| Attack | What is targeted | Private key compromised? |
|---|---|---|
| Address Poisoning | Recipient selection and visual similarity | No |
| Clipboard malware | Clipboard or compromised device | Not necessarily |
| Phishing | Trust in a fake website, message, or app | Not always; this is often the intention |
| Seed or private key theft | The wallet's signing secret | Yes |
Measured at scale
Hundreds of millions of attempts—it's not a rare event
A USENIX Security 2025 study tracked address poisoning on Ethereum and BNB Smart Chain between July 2022 and June 2024. Their detection system found the following activity.
These are estimates based on the study's detection methods and definitions, not a count of every poisoning attempt across all blockchains.
Protection in priority order
How to stop address poisoning from causing a loss
Always start with the recipient's original source. Extra checks are useful, but they can't fix an address copied from an untrusted history entry.
- 01
Never copy recipient addresses from your transaction history
Return to the recipient's verified source. History only shows what happened on-chain; it doesn't prove address ownership.
- 02
Use a verified address book or allowlist
Only save frequent recipients after verifying them through a separate trusted channel. Clear labels help you spot the trusted choice.
- 03
Verify the full address
Whenever possible, use a trusted address book, QR code, or a known source. If checking manually, don't just match the start and end—always verify the full address.
- 04
Check the hardware wallet's display
Always check the address displayed on your hardware wallet against the recipient address from a separate, trusted source. The device only shows what it will sign; it cannot confirm the intended recipient.
- 05
Confirm with a small test transfer
For large payments, send a small amount first and have the recipient confirm receipt before using the same verified address again.
- 06
Treat new recipients as a separate decision
Pause if your wallet warns about a new or similar address. Confirm it through another channel rather than ignoring the warning.
The device accurately displays the address it is about to sign, but it cannot verify the recipient. Always compare the shown address with a trusted, independent source before confirming.
Before you sign
- Recipient was taken from a trusted source, not from history
- Network and asset match what the recipient expects
- Full address matches on your trusted device's display
- The real recipient confirmed the test transfer
What wallet software can do
Good warnings help reduce risk, but no filter can confirm your intent
Wallets can spot suspicious patterns and slow users down at the right time. However, new attacker addresses and genuine lookalikes mean perfect detection isn't possible.
MetaMask
MetaMask states it compares new destinations with previous recipients and displays a blocking warning if the visible start and end match but the middle is different. It also warns for entirely new recipients.
Trezor Suite
Trezor states that Suite reviews suspicious token transfers, obscures likely poisoning entries, and labels them as unverified. The hardware wallet displays the address it will sign, but you should always compare it with the recipient address from a separately verified source.
Make trusted recipients stand out more than history entries
- Blur or filter out zero-value and suspicious dust entries
- Warn if a new address looks like a known contact
- Clearly label verified contacts and allowlists
- Display the full address when copying or signing
Suggested change to address display
ERC-8117 aims to make unusual address patterns easier to spot
ERC-8117 is a draft proposal for a compact visual format for EVM addresses with many leading zeros. The aim is to make the number of zeros clear and increase the difficulty of creating convincing lookalikes for those addresses.
It doesn't replace recipient verification and isn't a final Ethereum standard. Wallet and explorer support would still be needed.
Primary research and wallet documentation
Review the case, statistics, and current protections
The case study, attack data, wallet protections, and proposal status were verified using Chainalysis, USENIX Security, wallet provider documentation, Etherscan, and the official ERC page.
FAQs
Does an address poisoning entry mean my wallet was hacked?
No. Anyone can send a zero-value, dust, or token entry to your address on a public blockchain without your consent. This doesn't expose your seed phrase or private key. The real risk is copying the lookalike address for a future transfer.
Can I remove a fake transaction from my wallet history?
Once a transaction is confirmed on a public blockchain, it cannot be removed. Some wallets may hide or blur suspicious entries, but the safest approach is always to ignore them and independently verify every recipient before sending funds again.
Is it enough to check only the first and last four characters of an address?
No. Lookalike addresses are crafted to match the characters shown in shortened wallet views. If the middle is different, it's a different destination—always check the full address or use a previously verified contact.
What should I do if I've sent crypto to a poisoning address?
Stop any further transfers, keep the transaction details, contact your sending wallet or exchange, and report the destination to relevant providers or authorities. On-chain transfers are usually irreversible, so recovery cannot be guaranteed.
Does sending a small test transfer prevent address poisoning?
A test transfer is only effective if the intended recipient confirms it and you reuse the same verified address. If you copy a new address from poisoned history before the main transfer, the test won't help.
Is address poisoning the same as a dusting attack?
They can overlap, but they're not the same. Address poisoning uses a misleading history entry to influence future recipient selection. Dust can also be sent for tracking, spam, or other reasons without using a lookalike address.