When making a transfer, many people copy the address they used last time from their transaction history, check the first and last few characters, and hit confirm. Address poisoning targets exactly this habit.

Addresses that frequently send and receive stablecoins and $ETH are more likely to be targeted by address poisoning. Current price: 2445.18 (24h +0.031%).

What is address poisoning?

Attackers first target addresses that frequently send and receive stablecoins on-chain. They then use software to generate large numbers of addresses and pick out “lookalike addresses” whose first and last few characters match those of an address you commonly use.

Next, the attacker sends a tiny amount—or a zero-value token transfer—from the lookalike address, making it appear in your transaction history. The next time you copy an address from your history, you might accidentally copy the fake one.

A few common disguises:

Some token contracts allow transfers of 0 tokens. Attackers exploit this to leave an on-chain record showing “0 tokens transferred from your address,” making it look as if you sent tokens to that address yourself.

Others issue counterfeit tokens with names matching popular stablecoins and amounts close to what you usually transfer, making the record look more authentic.

Why it’s easy to fall for:

An address is a long string of characters. An Ethereum address has 40 hexadecimal characters, and most people only check the beginning and the end. It’s not hard to generate addresses with matching characters at both ends, so checking only those is exactly the blind spot scammers exploit.

This scam doesn’t need your private key or require you to sign any authorization. It relies only on you copying an address when making a transfer. Once an on-chain transfer is confirmed, it can’t be reversed, and assets sent to a similar-looking address are almost impossible to recover.

How to stay safe:

Save frequently used recipient addresses in your wallet or platform’s address book or withdrawal whitelist, and select them from there each time instead of copying them from your transaction history. Before transferring, check the entire address, including the characters in the middle.

For a large transfer, send a small amount first and confirm with the recipient that it arrived before sending the rest. Ignore small or zero-value transfers from unknown sources, and don’t save the sender’s address as a frequently used address.

Some wallets and block explorers flag suspicious zero-value transfers or hide them by default. Pay attention if you see a warning like this.

Here’s the practical takeaway:

Address poisoning doesn’t exploit a technical vulnerability; it exploits a habit that’s easy to fall into. Replace “copy from transaction history” with “select from the address book,” and take another look at the characters in the middle to avoid it. Treat any unsolicited “technical support” message as suspicious. Legitimate platforms will never ask for your recovery phrase.

What would you like to hear about next—DeFi or something else?