Address Poisoning Attacks: The Copy-Paste Trap Draining Wallets

Address poisoning is a scam in which an attacker plants a look-alike wallet address in your transaction history, usually by sending you a tiny or fake transfer, hoping you will later copy that address instead of the real one and send funds to the attacker. It does not hack your wallet; it exploits the habit of copying addresses from recent activity and checking only the first and last few characters.

The attack has become common on networks where stablecoins such as USDT and USDC are moved frequently, because large, repeated transfers between the same addresses are easy to spot on a public blockchain. Losses can be large because victims are often moving significant sums to addresses they trust. The good news is that a few simple habits stop it almost completely.

How an Address Poisoning Attack Works

The attack usually follows the same pattern:

1. 1Watching. The attacker monitors the blockchain for wallets that regularly send funds, for example from a personal wallet to an exchange deposit address.
2. 2Generating a look-alike. Using address-generating software, the attacker creates an address whose first and last characters match the destination you use. Wallet addresses are long, and many wallets shorten them to something like 0x1a2b...9f8e, so only those visible characters matter to the trick.
3. 3Poisoning your history. The attacker sends a transaction that makes the look-alike address appear in your activity. This might be a zero-value token transfer, a tiny amount of a real token, or a transfer of a fake token that copies the name of a real stablecoin.
4. 4Waiting. The next time you send funds, you open your history, see what looks like your usual address, copy it and send. The money goes to the attacker.

Because the fake entry appears in your own history, often right next to your genuine transfers, it feels trustworthy. For a deeper look, see Pig Butchering Scams.

Why the Trick Works So Well

Several everyday habits make people vulnerable:

• Truncated addresses. Wallets and explorers often display only the start and end of an address.
• Copying from history. It is convenient to copy "the address I used last time" instead of finding it from the original source.
• Fake tokens with real names. A transfer showing a token called "USDT" looks normal, even though the contract is fake.
• Routine. People who repeat the same transfer weekly tend to stop checking carefully.

When truncated, the two are identical. Only the full comparison reveals the difference. Our article Clipboard Malware expands on this point.

How to Protect Yourself

These habits shut down address poisoning almost entirely:

1. 1Never copy addresses from transaction history. Treat your history as a record, not an address book.
2. 2Use a saved address book or whitelist. Save verified addresses once, label them clearly, and send only to saved entries. Many exchanges also offer withdrawal address whitelisting.
3. 3Get addresses from the source. For an exchange deposit, copy the address fresh from the exchange's deposit page each time, checking the network.
4. 4Check the full address. Compare more than the first and last characters, ideally several segments in the middle as well.
5. 5Send a test transaction. For any large transfer, send a small amount first and confirm it arrives, as described in our guide to sending crypto without losing it.
6. 6Hide spam tokens. Use your wallet's spam or hide feature for unknown tokens so they do not clutter your view.
7. 7Confirm on your hardware wallet screen. If you use one, read the destination on the device before approving.

How to Recognize a Poisoning Attempt

Look for these signs in your activity:

• Incoming transfers of zero value or tiny amounts from addresses you do not recognize.
• Tokens with familiar names that you never bought, especially stablecoin look-alikes.
• An address in your history that resembles one of your regular contacts but appears shortly after you transacted with it.

On a block explorer, fake tokens often link to unofficial contracts. You can check whether a token is the real one by comparing its contract with the official address, as explained in our guide to verifying a token's contract address.

What to Do If You Sent Funds to a Poisoned Address

Blockchain transfers cannot be reversed, but a few steps are still worth taking:

• Record the transaction hash, addresses and time.
• If the funds passed through an exchange or stablecoin issuer, contact them immediately; some issuers can freeze tokens in certain cases.
• Report the incident to local police and your country's fraud reporting service, and report the scam address to us so we can warn others.
• Ignore anyone who contacts you offering guaranteed recovery for a fee. These "recovery services" are frequently a second scam.

For a deeper look, see Copy Trading Scams.

We cover this in more detail in Malware in Fake Crypto Job Coding Tests.

Related reading: Fake WalletConnect and Wallet Pop-Up Phishing.

Bottom line

Address poisoning does not break your wallet's security; it turns a convenient habit against you. Stop copying addresses from history, use a labeled address book or whitelist, compare the full address and send a test transaction before large transfers. Those few seconds of checking are the difference between a routine payment and an irreversible loss. For more defenses, browse our security guides.