What is address poisoning?
Address poisoning is a crypto scam technique where attackers insert a lookalike wallet address into a victim's transaction history to trick them into sending funds to the attacker.
It's often framed as a retail-user problem, but exchanges, custodians, over-the-counter (OTC) desks and wallet providers deal with it too.
Address poisoning shows up as dust transfers hitting customer accounts, withdrawal requests to lookalike addresses and customer support incidents tied to mistaken transfers.
How does an address poisoning attack work?
Crypto address poisoning attacks exploit a predictable user behavior: Users rarely type full 40-character wallet addresses by hand when sending funds. Instead, they copy and paste the recipient wallet address from their transaction history, matching the first and last few characters displayed in the wallet interface.
Attackers exploit this behavior by running scripts to generate millions of lookalike addresses that share matching prefixes and suffixes with legitimate addresses. Because wallets and block explorers show all transactions tied to an address, even if the user didn't initiate them, attackers can insert those vanity addresses into a victim's wallet history through zero-value transfers, dust transactions or fake-token transfers.
Attackers tend to target the sender of legitimate transfers and exploit a common practice: High-value senders typically send a small test transaction to a recipient before the real, larger one. This protective action signals to the attacker that a larger transfer is likely to follow.
And they move fast. Attackers can deliver phishing transfers within minutes of the legitimate transfer they were impersonating. This speed places the poisoned entry immediately adjacent to the test transfer in the victim's history, so it's more likely to be copied.
Why are address poisoning attacks effective?
Many wallets and blockchain explorers shorten addresses in their user interfaces, displaying only the beginning and end of the address rather than the full string.
Attackers exploit the fact that users typically verify only those visible characters, so a phishing address that matches the displayed prefix and suffix passes a quick glance even though the hidden middle differs entirely.
What are the main variants of address poisoning?
Address poisoning always ends with a lookalike address planted in the victim's transaction history. What varies is how the attacker plants it. Three methods are common.
Zero-value transfer attacks
Attackers can plant an entry without ever touching the victim's funds. For example, every token transfer on Ethereum leaves a public record, and the rules behind popular tokens like USD Coin (USDC) and Tether (USDT) allow a transfer of zero tokens to go through, even when someone other than the wallet owner starts it.
The attacker uses this to log a transfer of nothing, moving from the victim's wallet to a lookalike address. No money moves, but the entry appears in the victim's transaction history as though they had sent tokens to that address, waiting to be copied later.
This is the most common variant, because it's almost free. The attacker pays only the network fee, so a single campaign can poison huge numbers of wallets at once.
Fake token transfers
A zero-value entry always shows an amount of zero, which makes it easier to spot. To look more convincing, attackers create their own counterfeit tokens, using the same ERC-20 token standard that real assets like USDT and USDC are built on, and give them an identical name and symbol.
They then use these fakes to log transfers showing realistic amounts, so the poisoned entry blends in with genuine activity in the victim's history.
Dust-value transfers
Instead of faking a transfer, attackers can send a real one. In a dust transfer they send a tiny amount of a genuine token, often a fraction of a cent, from a lookalike address to the victim.
Because the transfer is real, they don't need any counterfeit tokens, but they do pay for the tokens they send. This was the original form of address poisoning. It's now less common, because the fake and zero-value methods achieve the same result more cheaply.
Regardless of the method, address poisoning leaves a similar on-chain footprint: a lookalike address appears in a wallet's transaction history. Because this activity is visible on-chain, analysts can identify address poisoning campaigns, trace attacker infrastructure and investigate major thefts.
Address poisoning vs dusting attacks
Address poisoning and dusting attacks are often confused because both put an unsolicited entry in a wallet's transaction history. But they pursue different goals.
A dusting attack sends small amounts of a cryptoasset to many wallets, then traces how that dust later moves in order to link addresses together and deanonymize their owner. The objective is tracking and clustering, not theft.
Address poisoning uses a lookalike address, delivered through dust, zero-value or fake-token transfers, to trick the victim into copying the wrong address and sending funds to the attacker. The objective is a direct loss through a copy-paste error.
The overlap is that dust transfers are one of the delivery methods address poisoning can use, which is why the terms blur. But dusting does not depend on address resemblance and address poisoning does not depend on tracing the dust afterward.
For compliance teams, that distinction shapes the response: Address poisoning is a direct fund-loss risk best addressed with withdrawal-time controls.
Notable address poisoning cases
WBTC exploit: $68 million nearly lost
In May 2024, a trader nearly lost $68 million in Wrapped Bitcoin (WBTC) after copying a poisoned address from transaction history.
The attacker had inserted a poisoned lookalike address into the victim's transaction history shortly before the victim initiated a transfer. After the victim mistakenly transferred the funds, tracing efforts by investigators, negotiations and public pressure ultimately led to the attacker returning the assets.
USDT theft: $50 million poisoning campaign
Another major case involved roughly $50 million in USDT tied to a suspected address poisoning attack in December 2025.
The victim had first sent a test transaction to the genuine address. An automated script monitored the test, generated a vanity address with matching characters and inserted a poisoned entry in the victim's history.
After the mistaken transfer, the attacker swapped the stolen USDT to DAI, converted it to ETH and routed the funds through Tornado Cash within roughly half an hour. The incident highlighted the growing role of stablecoins in poisoning campaigns, particularly on high-volume networks used by exchanges and OTC desks.
Address poisoning controls at the exchange layer
Exchanges and custodians can monitor for suspicious address behavior directly at the deposit and withdrawal layers. The controls below work best when used together.
Address-similarity heuristics. One of the most effective detection techniques involves identifying suspiciously similar addresses. Systems can compare:
- Address prefixes and suffixes
- Repeated character patterns
- Recently interacted counterparties
- Newly created vanity addresses
Clusters of highly similar addresses targeting the same customer or counterparty may indicate an active poisoning campaign.
Dust and zero-value transfer monitoring. Operations teams can also monitor for:
- Repeated zero-value transfers
- Unusual sub-cent dust transactions
- Fake token transfer events, from a contract inconsistent with the token contract
- Bursts of low-value activity tied to recently active addresses
These transactions land in the customer's wallet without moving customer funds, but often appear before successful phishing attempts. Thresholds should be calibrated by chain. Ethereum addresses give attackers more characters to work with than TRON addresses, but TRON's wider use for stablecoin remittances gives attackers more high-value targets.
Pre-withdrawal warnings. Many exchanges and wallet providers now implement withdrawal safeguards when users attempt to send funds to:
- Newly observed addresses
- Addresses recently associated with suspicious activity
- Lookalike addresses resembling prior counterparties
- Addresses linked to poisoning campaigns
A pre-withdrawal screening step can flag these patterns and interrupt the transfer before the victim sends funds to the attacker. A warning sent at the moment a customer is about to send funds gives them time to confirm the recipient wallet address.
By making an explicit character-by-character comparison of the two addresses, users can spot lookalike addresses before assets leave the platform. Additional verification or withdrawal holds may also be appropriate for higher-risk transactions.
Deposit-side transaction history hygiene. On the deposit side, several wallets, explorers and exchanges have started to hide or separate zero-value transfers from customer transaction histories, reducing the likelihood that users will copy a poisoned address in the first place.
Cross-chain exposure and behavioral tracing. Once funds have been sent to a poisoned address, the attacker begins laundering them. This typically follows a pattern: Funds move from the phishing address to an aggregator contract, are swapped through DEXs, coinswap services or mixers, and are then routed through multiple wallets to off-ramps.
Exchanges handling stablecoins across Ethereum, TRON and other networks need to monitor:
- Lookalike address infrastructure
- Shared attacker clusters
- Related deposit addresses
- Cross-chain laundering behavior
A single phishing address usually reveals a wider network of related funding addresses, batching contracts and fake-token contracts, because attackers reuse this infrastructure across thousands of poisoning attempts.
Sharing this intelligence internally and with blockchain analytics providers helps identify new campaigns more quickly, propagate blacklists and limit attackers' ability to cash out stolen funds.
Blockchain analytics solutions support these efforts by detecting poisoning activity, identifying related infrastructure and tracing funds when thefts occur. Cross-chain coverage matters significantly here, as address poisoning campaigns rarely stick to one blockchain. So does the attribution needed to map an attacker’s wider infrastructure. Providers vary widely on both fronts. Before you decide on one, read our 2026 guide to choosing a blockchain analytics provider.
