How address poisoning works and how to spot it
Lookalike addresses planted in your transaction history, the research that measured 270 million attempts, and the check that defeats them.
Published 3 min read
In short
In address poisoning, an attacker creates an address whose first and last characters match one you have used, then sends you a tiny or zero-value transfer from it so that it appears in your history. If you later copy the address from your history instead of from a trusted source, you pay the attacker.
A 2025 study of Ethereum and BNB Smart Chain counted 270 million such attempts against 17 million victims over two years, with at least $83.8 million lost in 6,633 incidents. The defence is to take addresses from a saved contact or the recipient directly and compare every character.
Long addresses are hard to read, so people shorten them in their heads. They check the first four characters and the last four, and they copy from wherever the address is most convenient, which is often their own recent transactions. Address poisoning is built on both habits.
What does the attack look like?
- The attacker watches the chain for an address that sends funds regularly, and notes who it pays.
- The attacker generates a lookalike: a new address whose beginning and end match the real recipient’s. Producing such an address only takes computing time.
- The attacker poisons the history. They send the victim a transaction from the lookalike: a tiny amount, a fake token, or, on networks with token contracts, a zero-value transfer. The lookalike now appears in the victim’s wallet history, next to the real recipient.
- The victim copies the wrong one. Next time they pay that recipient, they copy the address from their history, see the familiar start and end, and send the funds to the attacker.
No key is stolen and no device is compromised. The victim signs a valid transaction to an address they chose themselves, which is why the money cannot be pulled back.
How common is it?
The most thorough measurement so far is the paper “Blockchain Address Poisoning” by Taro Tsuchiya, Jin-Dong Dong, Kyle Soska and Nicolas Christin, presented at the USENIX Security Symposium in 2025. Studying Ethereum and BNB Smart Chain over two years, the authors identified 270 million on-chain attack attempts aimed at 17 million victims, which they describe as thirteen times more attempts than previously reported. They found 6,633 incidents in which victims actually paid an attacker, with at least $83.8 million in losses.
The scale reflects the economics: sending millions of near-free transactions costs the attacker little, and a single successful mistake by a large holder pays for all of them.
Why are some networks more exposed than others?
On Ethereum-style networks, token transfers go through contracts that follow standards such as EIP-20. Attackers exploit the way transfers appear in wallets and explorers, including transfers of zero tokens and fake tokens that imitate real ones, so that a poisoned entry looks like ordinary activity. On Bitcoin, sending a small amount to plant an address costs a real fee per attempt, but the copy-from-history mistake is the same.
How do I protect myself?
| Habit | Why it works |
|---|---|
| Copy addresses from a saved contact or a fresh request from the recipient, never from your transaction history | The poisoned entry lives in the history |
| Compare the whole address, not the first and last few characters | Lookalikes are built to match exactly those characters |
| On a hardware wallet, compare the address on the device screen with the source | The device shows exactly what you are about to sign |
| Send a small test payment to a new recipient and confirm with them before sending the rest | A mismatch costs only the test amount |
| Ignore unexpected tiny deposits and unknown tokens | They are often the poisoning step itself |
Some wallets now hide zero-value transfers or flag addresses that resemble known contacts. Those features help, but they are a net under the habit, not a replacement for it.
What if it has already happened?
The transaction cannot be reversed by the network. Record the transaction ID, both addresses and the time, and report it: in the US, to the FBI’s Internet Crime Complaint Center. Be wary of anyone who then offers to recover the funds for a fee; recovery scams target exactly these victims, as described in how pig butchering scams work.