What is address poisoning?
Address poisoning is a scam where an attacker sends a zero-value or tiny transfer from an address that looks like one the victim uses, matching the first and last characters. The fake address then appears in the victim's transaction history, and if they later copy it from there, they send funds to the attacker.
How it works
- The attacker watches for addresses that make regular transfers.
- They generate an address that shares its first and last characters with one the victim sends to.
- They send a zero-value token transfer or a tiny amount from that address, so it shows up in the victim’s history.
- The victim, copying a “recent” address, picks the lookalike and sends funds to the attacker.
Defences
- Users: use saved address books, verify the whole address, and never copy addresses from transaction history.
- Wallets: filter dust and zero-value transfers, and warn on lookalike destinations.
- Exchanges and treasuries: use allowlisted withdrawal addresses and test transfers for new destinations.
Questions
Frequently asked questions
Can address poisoning steal funds without the user doing anything?
No. It relies on the user copying the wrong address from their history. That is why wallet design and user habits matter.
How can wallets help?
By hiding or flagging zero-value and dust transfers, warning when a destination closely resembles a recent address, and encouraging saved, labelled address books.
Published Updated