Wallet security, explained simply
Address Poisoning: How Fake Wallet Addresses Get Into Your Transaction History
A scammer does not need your seed phrase or private key. One lookalike address in your transaction history can be enough if you copy it later without checking the full recipient.
Quick answer
What is address poisoning?
Address poisoning is a crypto scam that places a fake, similar-looking address in your wallet or explorer history. The fake entry does not control your wallet. The danger begins only if you copy that address and approve a new transfer to it.
Seeing an unknown zero-value or dust transfer does not mean your wallet has been breached. Do not interact with it, and do not use its address as a future recipient.
Table of Content
3 May 2024 · Ethereum
$68 million went to the wrong address—and then came back
Chainalysis describes the first small transfer to the intended address as a likely test payment. Minutes later, the wallet sent roughly 1,155 WBTC to a different address that looked almost identical when shortened. That second address belonged to the scammer.
The victim had signed the wrong recipient. Ethereum processed that instruction correctly. The scammer later returned the original $68 million on 9 May after the victim sent public on-chain messages, but the unusual recovery does not make the transfer reversible or safe.
The repayment was made in ETH rather than the original WBTC. Chainalysis estimates that the scammer still kept about $3 million from the asset's price appreciation.
A test transfer helps only when the confirmed recipient is reused from a trusted source. Copying a fresh lookalike from history can still redirect the larger payment.
The attack chain
How address poisoning works, one step at a time
The attack targets the moment when a person chooses a recipient. It does not need to break the wallet's cryptography.
- 01
A real payment becomes public
The victim sends crypto to a legitimate recipient. The blockchain records both addresses publicly.
- 02
The recipient pattern is observed
A scammer watches public activity and identifies an address the victim may use again.
- 03
A lookalike address is prepared
The fake address shares visible characters with the real recipient but belongs to the scammer.
- 04
A misleading entry reaches the history
A zero-value, dust, or token transfer makes the lookalike appear in a wallet or explorer.
- 05
The wrong address is copied
Later, the victim selects the familiar-looking entry instead of returning to a trusted source.
- 06
A valid transaction goes to the scammer
The victim signs the transfer. The blockchain sends the funds exactly where the approved address points.
The visual trap
The beginning and end can match while the address is different
Wallets often shorten long addresses. That saves space, but it can hide the exact part a scammer changed.
0x91A4b7C2e6F1930DABCD8a45B6cE19fA003172F80x91A4f3D8c4E7192BCAFE6a90C1dE48B700A972F8What a shortened history may show
0x91A4…72F8
0x91A4…72F8Why it appears in your wallet
Public history accepts entries you did not ask for
Public blockchains let anyone inspect addresses and send permitted transactions or tokens. A wallet can display that activity even when you never approved it.
Zero-value transfer
A token event with no economic value can still create a visible history row in some wallets or explorers.
Dust transfer
A very small amount is sent so the lookalike address appears among real activity.
Spoofed token activity
A worthless or misleading token can imitate the name or amount of an earlier transfer and make the entry look familiar.
Copied transaction details
The poisoning entry may repeat a previous amount or timing pattern so that it resembles an earlier legitimate interaction.
You cannot erase a confirmed public blockchain record. Some wallets can hide or blur suspicious entries. Either way, the entry alone cannot spend your funds.
No. Do not reply, return dust, visit token links, or copy the sender address. Ignore the entry and verify future recipients independently.
Know what was attacked
Address poisoning is not a blockchain or private-key hack
The transaction is valid because the owner approves it. The deception happens before signing, when the fake recipient is mistaken for the real one.
| Attack | What is targeted | Private key compromised? |
|---|---|---|
| Address Poisoning | Recipient choice and visual similarity | No |
| Clipboard malware | Clipboard or infected device | Not necessarily |
| Phishing | Trust in a fake site, message, or app | Not necessarily; often the goal |
| Seed or private-key theft | The wallet's signing secret | Yes |
Measured at scale
Hundreds of millions of attempts, not a rare accident
A USENIX Security 2025 study measured address poisoning on Ethereum and BNB Smart Chain from July 2022 through June 2024. Its detector found the following activity.
These are study estimates based on its detection method and definitions, not a count of every poisoning attempt on every blockchain.
Protection in priority order
How to prevent address poisoning from becoming a loss
Start with the source of the recipient. Extra checks help, but they cannot repair an address copied from an untrusted history entry.
- 01
Do not copy recipients from transaction history
Return to the recipient's verified source. History shows what happened on-chain; it does not prove who owns an address.
- 02
Use a verified address book or allowlist
Save frequent recipients only after checking them through a separate trusted channel. Labels make the trusted choice easier to recognize.
- 03
Verify the full address
Use a verified address book, QR code, or known source whenever possible. If you compare manually, do not stop at a matching beginning and end; verify the entire address.
- 04
Check the hardware-wallet display
Compare the address shown on the hardware wallet with the recipient address from an independent, trusted source. The device shows what it will sign; it cannot know who should receive the payment.
- 05
Confirm a small test transfer
For a high-value payment, send a small amount first and have the real recipient confirm receipt before reusing the same verified destination.
- 06
Treat new recipients as a separate decision
Pause when a wallet warns about a new or similar address. Verify it through another channel instead of dismissing the warning.
It reliably shows the address it is about to sign, but it cannot know who should receive the payment. Compare the displayed address with an independent, trusted source before approval.
Before you sign
- Recipient came from a trusted source, not history
- Network and asset match what the recipient expects
- Full address matches on the trusted display
- A test transfer was confirmed by the real recipient
What wallet software can do
Good warnings reduce risk, but no filter can verify intent
Wallets can detect suspicious patterns and slow users down at the right moment. New attacker addresses and legitimate lookalikes still make perfect detection impossible.
MetaMask
MetaMask says it compares a destination with earlier recipients and shows a blocking warning when the visible beginning and end look familiar but the middle differs. It also warns about a completely new recipient.
Trezor Suite
Trezor says Suite checks suspicious token transfers, blurs likely poisoning entries, and marks them as unverified. The hardware wallet shows the address it will sign, but you must compare it with the recipient address from an independently verified source.
Make the trusted recipient more visible than the history
- Blur or filter zero-value and suspicious dust entries
- Warn when a new address resembles a known contact
- Label verified contacts and allowlists clearly
- Show the full address when copying and signing
A proposed display change
ERC-8117 tries to make unusual address patterns easier to read
ERC-8117 is a draft proposal for a compact visual format for EVM addresses with long runs of leading zeros. It aims to make the zero count obvious and raise the cost of creating a convincing lookalike for those addresses.
It does not replace recipient verification, and it is not a final Ethereum standard. Wallet and explorer support would still be required.
Primary research and wallet documentation
Check the case, measurements, and current protections
The case study, attack measurements, wallet protections, and proposal status were checked against Chainalysis, USENIX Security, wallet-provider documentation, Etherscan, and the official ERC page.
FAQ
Does an address poisoning transaction mean my wallet was hacked?
No. An unexpected zero-value, dust, or token entry can be sent without your permission on a public blockchain. It does not reveal your seed phrase or private key. The risk is copying the lookalike address into a future transfer.
Can I delete a fake transaction from my wallet history?
A confirmed public blockchain record cannot be deleted. Your wallet may hide or blur suspicious entries, but the safe response is the same: ignore them and verify every future recipient from a trusted source.
Is checking the first and last four address characters enough?
No. Lookalike addresses are designed to match the characters that shortened wallet views display. A different middle creates a different destination, so verify the full address or use a previously verified contact.
What should I do if I sent crypto to a poisoning address?
Stop further transfers, preserve the transaction details, contact the sending wallet or exchange, and report the destination to relevant providers or law enforcement. On-chain transfers are normally irreversible, so nobody can promise recovery.
Does a small test transfer prevent address poisoning?
It helps only when the intended recipient confirms it and the same verified address is reused. A test does not help if a fresh address is copied from poisoned history before the larger transfer.
Is address poisoning the same as a dusting attack?
They can overlap, but the terms are not identical. Address poisoning uses a misleading history entry to influence a future recipient choice. Dust can also be sent for tracking, spam, or other purposes without using a lookalike address.