Address poisoning is an attack where a thief plants a fake address in your transaction history that closely mimics one you already use, usually by sending a tiny or zero-value transfer. The trap springs later, when you copy that lookalike from your own history and send real funds straight to the attacker.
What is address poisoning, in plain English?
Address poisoning exploits two habits: wallet apps shorten long addresses for display, and people copy addresses from recent activity instead of a verified source. The attacker crafts a wallet address whose first and last characters match one you use often, then sends you a tiny or zero-value transfer from it. That transaction now sits in your history, next to the real counterparty, looking almost identical.
Later, when you go to pay that counterparty again, you scroll your history, see what looks like the right address, and copy it. Because the middle of the address is hidden and only the ends match, the swap is easy to miss. The funds go to the attacker, and on-chain there is no undo.
For investigators, address poisoning shows up as an unsolicited, near-lookalike counterparty appearing in a victim's history shortly before a misdirected payment. It is a social-engineering attack dressed up as an on-chain event: the ledger is doing exactly what it should, while the human is tricked into choosing the wrong recipient.
How an address poisoning attack works
- Target — Study the history. The attacker watches wallets and notes addresses a target pays repeatedly.
- Craft — Generate a lookalike. They grind out an address whose starting and ending characters match the real counterparty.
- Poison — Send dust or a zero-value transfer. A tiny or zero-value transaction plants the lookalike address in the target's transaction list.
- Wait — Let the habit take over. The victim later copies the lookalike from history and sends real funds to the attacker.
Who is involved?
Who | Their role |
The attacker | Generates the lookalike address and seeds it into the victim's history with a dust transfer. |
The victim | Copies the poisoned address from recent activity and unknowingly pays the attacker. |
The wallet app | Shortens addresses for display, which hides the mismatched middle and makes the lookalike convincing. |
The analyst or platform | Sees the near-lookalike counterparty and the misdirected payment and can warn or intervene. |
What it looks like in practice
In practice
A treasury operator regularly pays a supplier at an address that starts with 0x9f2a and ends in 4c1d, shown in the app as 0x9f2a...4c1d. One morning a zero-value transfer arrives from an address that also starts 0x9f2a and ends 4c1d, but whose hidden middle is entirely different.
The next week the operator sends a routine payment, taps the most recent matching entry in the history, and confirms. The ends matched, so it looked right. The money lands with the attacker, the real supplier never gets paid, and the transaction cannot be reversed. The only clue before the loss was that unsolicited near-lookalike sitting in the activity log.
Why it is dangerous for operators
Address poisoning is dangerous because it bypasses the wallet's security entirely and targets the person. Nothing is hacked; the victim voluntarily signs a valid transaction to the wrong address. That makes it invisible to controls that watch for malicious approvals or compromised keys, and irreversible once confirmed. High-volume payers such as treasuries, exchanges, and OTC desks are prime targets because they move funds often and rely on copy-paste.
For a monitoring team, the value is in the early tell. The poisoning transaction usually arrives before the loss, so flagging unsolicited lookalike counterparties gives a window to warn users and block a misdirected send. Enforcing verified address books instead of copy-from-history removes the vulnerability at the source.
What to watch in the data
- Unsolicited dust from a lookalike. A tiny or zero-value transfer from an address that mirrors a known counterparty's first and last characters.
- Prefix and suffix match, middle mismatch. Two addresses sharing only their ends is the defining signature of a poisoning attempt.
- Payment shortly after poisoning. A real transfer to the lookalike soon after it appears is a completed attack.
- Copy-from-history behavior. Users who select recipients from recent activity rather than a saved contact are the ones at risk.
- Shortened-address displays. Interfaces that truncate the middle make the swap invisible; treat any lookalike as high priority.
Quick questions
Why does the tiny transfer matter?
The transfer itself is worthless; its only job is to place the attacker's lookalike address into your transaction history. Once it is there, the attacker is betting you will copy it later instead of a verified source.
Can the funds be recovered after a misdirected send?
Usually not. The transaction is valid and on-chain settlement is final, so there is no chargeback. Recovery depends on tracing the funds to a KYC off-ramp and getting law enforcement or the venue involved, which is slow and uncertain.
How is this different from approval phishing?
Approval phishing tricks you into granting a contract permission to move your tokens. Address poisoning never touches permissions; it just tricks you into typing or pasting the wrong recipient. Both rely on deception rather than a technical breach.
Does it overlap with dusting attacks?
The mechanics rhyme: both send tiny unsolicited amounts. A dusting attack aims to deanonymize by linking addresses; address poisoning aims to redirect a future payment. The intent, not the dust, is what separates them.
What is the simplest defense?
Never paste an address from transaction history. Verify the full address end to end, and use saved contacts or an allowlist for repeat counterparties. Confirming a few middle characters, not just the ends, defeats almost every lookalike.
Why are treasuries and desks common targets?
They send large amounts to the same counterparties repeatedly, often under time pressure, and lean on copy-paste. That combination of habit, speed, and value is exactly what the attack is designed to exploit.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.