What is address poisoning?

A scam in which an attacker sends a tiny or zero-value transfer from an address that closely resembles one you use, hoping you will later copy the wrong address out of your transaction history.

The lookalike matches the first and last characters, which is all most interfaces display, so it survives a careless glance. The fix is procedural rather than technical: never copy an address from history, verify the full string against the recipient's own record, and send a small test transfer first for a new destination.

This is an attack on your habits, not on your keys. Nothing is stolen at the moment of poisoning. The loss happens days or weeks later, when you go to repeat a withdrawal you have made before and reach for the most convenient copy of the address.

How it works

The attacker generates addresses in bulk until one shares the leading and trailing characters of an address you already send to. Because an address is derived from a public key, generating candidates is cheap and matching a short prefix and suffix takes ordinary hardware.

They then push a transaction into your history from that address. On chains where transfers cost little this is a dust transfer of a fraction of a cent. On Ethereum-style chains, a token contract can emit a transfer event log with a zero amount that costs the attacker almost nothing and still appears in explorers and wallet feeds.

Your wallet's activity list now contains the attacker's address, sitting next to the real one, abbreviated to something like the first six and last four characters. Both look identical in that form.

The theft is your own transaction. You copy the wrong row, sign, and the funds go to an address nobody else controls. Nothing reverses it, because nothing was hacked.

Example

Illustrative: your exchange deposit address begins 0x7f2a and ends c41d. The attacker mints an address that also begins 0x7f2a and ends c41d and sends you a zero-value token transfer. Your wallet shows two rows reading 0x7f2a...c41d. You paste the newer one and send $4,000. The middle 32 characters differed, and the interface never showed them.

Why it matters when you buy

The moment you are most exposed is the one right after a purchase, when you move coins from an exchange to your own wallet or back. Save destinations once, verified in full, in an address book and use them by name thereafter. Never rebuild an address from your own transaction feed. See the guide on address poisoning and clipboard attacks for the full checklist.

Related terms

• address book — saved destinations you do not retype
• dusting attack — the related tiny-transfer surveillance tactic
• clipboard malware — swaps the address as you copy
• deposit address — the string being impersonated
• transaction id — how you confirm where funds actually went
• block explorer — where you check the full address

Questions

Is the tiny incoming transfer itself dangerous?

No. Receiving it costs you nothing and does not give anyone access to your wallet. The danger is only that it plants a lookalike address in your history. Do not interact with the token; just ignore it.

Can I block these transfers?

Not on a public chain, because anyone can send to any address. Some wallets now hide zero-value and unknown-token transfers by default, which removes the bait without removing the transaction.

What do I do if I already sent to a poisoned address?

Nothing on chain will recover it. If the amount is large, report it to the exchange that issued the funds and to law enforcement, since the receiving address may later be flagged by chain analysis when the attacker tries to cash out.