Address Poisoning Attacks: How Scammers Steal Crypto With Fake Wallet Addresses

Here's how it plays out. You send crypto to a wallet address you use regularly — a friend, an exchange, your own cold wallet. A scammer watching the blockchain sees that transaction. Within minutes, they send you a tiny amount — sometimes less than a cent — from a wallet they control.

That wallet's address starts and ends with the same characters as the real one you just sent to. Your wallet shows the fake transaction in your history. The next time you need that address, you scroll back, copy it, and paste. The first 4 characters match. The last 4 match. You send.

The middle 32 characters are completely different. The money is gone.

How address poisoning actually works

Scammers write scripts that monitor the mempool — the pool of unconfirmed transactions — for outgoing transfers. The moment they spot one, they generate a wallet address with matching prefix and suffix characters, then send a dust transaction (sometimes $0.001) to your wallet from that address.

Most modern wallets display addresses shortened: the first 6 characters, three dots, the last 4. That's exactly what the attacker matches. They can generate thousands of vanity addresses per second until they find one that matches.

The attack costs almost nothing. One successful hit on a $50,000 transfer pays for years of operation.

Why your normal address-check habit isn't enough

Most crypto users check the first 4 and last 4 characters of an address before sending. This habit exists because full addresses are 42 characters long and impossible to read at a glance. The problem: address poisoning is built specifically to defeat this check.

Poisoned addresses don't slip through because you were careless. They slip through because you were doing exactly what you were supposed to do — and the attack exploits that behavior.

On-chain signals of a poisoned address in your history

Not every dust transaction is an attack, but these patterns together are a strong signal:

• •Incoming amount is tiny — fractions of a cent, a few tokens worth almost nothing
• •The sending wallet is brand new with no prior transaction history
• •The transaction arrived shortly after one of your outgoing transfers
• •The sending address looks visually similar to an address in your history
• •The same dust was sent to dozens or hundreds of wallets in the same block

Three habits that prevent this

Verify the full address, not just the ends. Before sending anything significant, paste the destination address into a text editor and read it from start to finish. It takes 10 seconds. The $71M loss would have been caught this way.

Use your wallet's address book. MetaMask, Rabby, and most hardware wallets let you save named contacts. Copy the address once, verify it fully, save it with a name like "My Ledger" or "Exchange Hot Wallet." From then on, select it from the address book instead of copying from transaction history.

Send a test transaction first. For any new recipient or large transfer, send $1 first. Confirm it arrived at the right place before sending the full amount. This adds one minute and has saved real money for real people.

You can also learn to read blockchain transactions on Etherscan to verify the full details of any transfer before it becomes a problem.

Frequently asked questions