Address poisoning is a scam where an attacker sends you a tiny, worthless transaction from a wallet address deliberately designed to look almost identical to one you’ve used before, so that later, when you go to copy a “familiar” address from your transaction history, you copy theirs instead and send your funds straight to them.
What looks like a simple mistake can cost millions. Two recent cases show how costly one mistake can be. In December 2025, an Ethereum user sent nearly $50 million in USDT to a poisoned address, according to blockchain security firm SlowMist.
In another report, another user made the same mistake and lost 4,556 ETH, worth about $12.25 million at the time. Both had completed the same kind of transaction correctly hundreds of times before, and both got it wrong once. Together, the two cases cost victims more than $62 million.
How Does Address Poisoning Work?
Every crypto wallet address is a long string of letters and numbers. Nobody reads all 42 characters every time. Most people glance at the first few and the last few and assume the middle matches, because it usually does.
Attackers exploit exactly that habit. Here’s the sequence:
- They watch the blockchain. Every transaction is public, so bots scan for wallets that move money regularly, especially large stablecoin transfers, since those wallets are the highest-value targets.
- They generate a lookalike address. Using GPU-powered vanity address tools, an attacker can produce thousands of wallet addresses per second until they find one that shares the same opening and closing characters as a real address you’ve used, with different characters hidden in the middle.
- They send you “dust.” A near-zero-value transfer, sometimes fractions of a cent, arrives from that lookalike address. You never asked for it, and you may never notice it. It just sits in your transaction history, waiting.
- You copy the wrong one. Weeks later, you go to send funds to that same contact. Instead of typing the address out, you scroll your history, find something that looks right, and copy it. If you grab the poisoned entry instead of the real one, the funds go to the attacker, and there’s no undo button on a blockchain.
The scale of address poisoning is growing quickly. Blockaid recorded 628,000 poisoning attempts in November 2025, rising to 3.4 million in January 2026. That is a 5.5-fold increase in just two months.
Lower Ethereum fees also made these attacks cheaper to carry out. Attackers can now send large numbers of small transactions to create fake addresses and increase the chance that users copy one by mistake.
Why Does This Matter If You’re New to Crypto?
If you’re just getting comfortable holding crypto, trusting your own transaction history feels reasonable. Address poisoning turns that exact instinct into vulnerability.
The success rate per attempt is tiny, only about 0.03% of poisoned addresses ever receive more than $100 from a victim, but attackers run the scam against millions of wallets at once, so volume makes it profitable anyway. One attacker contract sent 3 million dust transfers to over 1 million addresses for about $5,175 total. If you’re active on-chain at all, you’ve likely already received poisoned dust without knowing it.
Crypto puts the entire burden of verification on the sender. There’s no bank to call and reverse a mistaken transfer. Understanding how wallets, addresses, and private keys work is what makes every other security habit make sense.
How to Protect Yourself From Address Poisoning
None of these steps require special tools or technical skill, just a change in habit around the moment you copy an address and hit send. Here’s what works:
1. Read the Whole Address, Not Just the Ends
This is the single habit that stops address poisoning. Attackers rely on you checking only the first and last four to six characters. Before confirming any transfer, compare the full string against your saved record, ideally character by character.
2. Never Copy an Address Straight From Your Transaction History
Poisoned addresses are planted there specifically so you’ll grab them. Copy from a source you control instead: a saved contact, a verified address book entry, or an address you typed and confirmed yourself.
3. Use Your Wallet’s Own Address Book or Whitelist Feature
Most major wallets let you save a verified address once, label it, and reuse the saved entry going forward. That removes the copy-paste step entirely for addresses you use often.
4. Send a Small Test Transaction First
For any transfer above a few hundred dollars, send a small amount first and confirm it arrived before sending the rest. It costs a network fee. It also would have saved every victim in the cases above.
5. Scan a QR Code Instead of Typing or Pasting When You Can
A QR code encodes the full address and removes the character-by-character comparison entirely.
6. Turn On Your Wallet’s Built-In Poisoning Detection
MetaMask now flags any pasted address that shares a start and end with a previously used address but differs in the middle, and Trust Wallet added a similar real-time check in 2026. If your wallet offers this, make sure it’s switched on.
7. Verify the Address on Your Hardware Wallet’s Screen
If you use a hardware wallet, the confirmation screen on the device itself matters, since malware on a computer or phone can alter what’s displayed elsewhere. A Ledger device forces you to check the destination address on its own screen before signing, which is exactly the extra checkpoint address poisoning is designed to slip past.
8. Consider a Web3 Domain Name for Addresses You Use Often
Services that let you replace a long address with a readable name reduce how often you’re comparing strings of random characters in the first place.
Common Mistakes That Lead to Address Poisoning Losses
Most victims aren’t careless, they’re just following habits that feel safe until this specific scam exploits them.
- Trusting a “familiar-looking” entry in your history. The whole scam depends on this. Your transaction history is not a verified contact list, it’s a public record anyone can write to.
- Treating small “dust” transfers as harmless. A transfer worth a fraction of a cent from an unknown address is not a curiosity. It’s very often reconnaissance for a later scam, and it belongs nowhere near your copy-paste habits.
- Skipping the test transaction on a “routine” transfer. Both the $50 million and the $12.25 million losses documented above happened on transfers the victims had made the same way many times before. Familiarity is what attackers count on.
- Assuming a wallet interface alone can’t be fooled. Malware and interface-level tricks exist that display one address while sending to another, which is why the verification step on a hardware wallet’s own screen matters, not just what your browser shows.
- Not updating your wallet. Address poisoning detection is a recent feature addition at several major wallets. An outdated app version may not have it yet.
Secure Your Wallet Address Book Today
Open your wallet right now and check whether address poisoning detection is turned on, then save the two or three addresses you send to most often into a proper address book entry instead of relying on your history. That’s the entire fix, and it takes less time than the transaction you were about to send.
Frequently Asked Questions
A few questions come up often once people understand how the scam works.
Is address poisoning the same thing as clipboard-hijacking malware?
No, though they target the same moment in a transaction. Address poisoning never touches your device, it works by planting a lookalike address in public transaction history and relying on you to copy it. Clipboard malware, by contrast, infects your device directly and silently swaps a real address for a fake one the instant you paste it.
Can I get my funds back if I send crypto to a poisoned address?
Blockchain transactions cannot be reversed once confirmed, so recovery depends entirely on what happens to the funds afterward and who controls the receiving wallet, not on the network itself. Some cases have led to partial recovery when funds moved through an exchange with know-your-customer requirements before an attacker could withdraw them, but this is the exception, not something to plan around.
Do I need to worry about this if I only hold a small amount of crypto?
The habits matter regardless of the amount, since attackers scan blockchains broadly rather than checking balances first. The dollar figures in the news tend to involve large wallets, but the dusting technique that starts every one of these attacks gets sent to ordinary wallets just as often, including a case where a user lost $100,000 in USDT to the same tactic.
Which wallets currently have built-in address poisoning protection?
MetaMask and Trust Wallet both rolled out real-time detection for this specific attack pattern during 2026, flagging pasted addresses that resemble ones you’ve used before. Check your specific wallet’s security settings, since coverage and detection methods vary by provider and version.
