Address Poisoning Attacks: The Wallet History Scam
An address poisoning attack is a crypto scam where an attacker plants a lookalike wallet address in your transaction history and waits for you to copy the wrong destination later. Your seed phrase may still be safe, your private key may still be safe, and your wallet may still be working exactly as designed, but one bad copy-and-paste can send real money to the attacker.
If you move crypto between an exchange, a hot wallet, and cold storage, this is worth understanding. The scam works because most of us recognize wallet addresses by the first few characters and the last few characters. Attackers know that, and they build addresses that look familiar enough at a glance.
What is an address poisoning attack?
Address poisoning is a lookalike-address scam that pollutes your wallet activity feed with an attacker-controlled address. The attacker wants their address to resemble a real address you used before, especially when your wallet shortens addresses on screen.
MetaMask says the scam relies on users copying the wrong address from transaction history. Elliptic describes the same goal: insert a lookalike wallet address into the victim’s history so a later transfer goes to the attacker. Academic research also ties the attack to long hard-to-memorize addresses and recent-history selection. [S4] [S5] [S1]
The key point is practical: a public wallet address can receive unwanted activity. That alone does not give the sender control of your wallet. The risk shows up when you treat that activity feed like a trusted address book.
Why does address poisoning work?
Address poisoning works because wallet addresses are long, ugly strings that humans were never meant to memorize.
A typical Ethereum-style address starts with 0x and then a long run of letters and numbers. Many apps shorten that to something like 0x1234...abcd. If the attacker’s address shares the same beginning and ending characters as the real one, the poisoned entry can look close enough when you are moving fast.
MetaMask notes that users often recognize addresses by the beginning and end. Bitquery explains that the middle can be completely different and still go unread. Tsuchiya, Dong, Soska, and Christin also describe address length and recent-history selection as part of the weakness. [S4] [S8] [S1]
That is why this scam hits normal people. The user interface asks you to compare random strings while money is on the line. Most people take shortcuts. Attackers build around those shortcuts.
How does the attack usually happen?
The flow is simple.
- You make a legitimate transfer to or from your wallet.
- An attacker or bot notices the activity on-chain.
- The attacker creates an address that matches part of the real address, usually the prefix, suffix, or both.
- The attacker sends a tiny transfer, zero-value transfer, or fake-token transfer involving your wallet.
- The activity appears in your wallet app or block explorer history.
- Later, you copy the lookalike address and send real funds to it.
Researchers have identified tiny or dust transfers, zero-value transfers, and counterfeit or fake-token transfers as common variants. Different sources use slightly different terms, but the practical purpose is the same: create a wallet-history entry that looks safe enough to copy. [S1] [S2] [S5] [S9]
A dust transfer means a very small amount of crypto or token value was sent to your address. A zero-value transfer may show activity with no real value moved. A fake-token transfer may use a counterfeit token name or symbol so the row looks more legitimate.
By itself, seeing one of these entries does not mean your funds are moving. The danger starts when you click it, copy from it, or mistake it for a real past destination.
Test transactions help only when you verify the second send
Test transactions are still useful. If you are sending a meaningful amount, a small test can limit damage if something is wrong.
The missing habit is where you copy the address for the larger transfer.
Chainalysis notes that small test payments can help prevent larger losses when the test goes wrong first. Elliptic says attackers can deliver phishing transfers within minutes of a legitimate transfer. Bitquery reports one case where a counterfeit transfer appeared 12 seconds after a USDT test transfer. [S6] [S5] [S8]
So the safer rule is simple: send the test transaction to an address copied from a trusted source, then send the larger transaction to that same trusted source again. Do not use the new transaction-history row as your address book.
For example, if you are withdrawing USDC from an exchange to your hardware wallet, get the address from the wallet screen or a saved verified contact. Send the test. Confirm it arrived. Then go back to the verified source for the larger withdrawal.
It feels slower because it is slower. Compared with losing funds, that extra minute is cheap.
How common are address poisoning attacks?
The numbers vary by chain, token, date range, and detection method, so one figure should not be treated as the global total.
A USENIX Security 2025 paper measured more than 270 million attack attempts targeting more than 17 million victims on Ethereum and BNB Smart Chain between July 1, 2022 and June 30, 2024. The study found 6,633 successful transfers totaling at least $83.8 million. Etherscan reproduced that table and broke the measured losses into about $79.3 million on Ethereum and about $4.49 million on BNB Smart Chain. [S1] [S7]
A separate ACM CCS 2024 Ethereum study measured more than 14 million phishing transfers targeting over 1.44 million benign addresses from Ethereum blocks produced between November 2022 and February 2024, with about $81.96 million to $89.93 million in confirmed losses under its method. [S2]
Do not add those numbers together. They use different scopes. The useful takeaway is that address poisoning has been measured at large scale, the success rate is low, and the losses can still be serious because one successful mistake can be huge. Chainalysis reported a 0.03% campaign success rate over $100, while Bitquery measured a 0.019% success rate in a 12-month Ethereum dataset. [S6] [S8]
How do you prevent address poisoning?
The safest habit is to stop using transaction history as the source of truth for wallet addresses.
Use a verified address source instead. That may be a saved contact in your wallet, an exchange withdrawal address book, a deposit address from the recipient’s current app screen, a QR code from the trusted recipient, or an on-device confirmation screen from a hardware wallet.
For meaningful transfers, use this checklist:
- Copy the recipient address from a trusted source, not wallet history. [S4] [S5] [S8] [S9]
- Check the full address, including the middle characters. [S4] [S8]
- Use contacts, address books, private name tags, or exchange allowlists for recurring destinations. [S4] [S7]
- Treat unknown dust, zero-value transfers, and fake-token entries as untrusted history noise. [S4] [S5] [S7] [S9]
- For high-value sends, compare the destination on the hardware-wallet screen before approving. [S4] [S9]
- If you send a test transaction, copy the larger-transfer destination from the same trusted source used for the test. [S6] [S8] [S5]
This is plain copy-and-paste discipline. That is exactly why it matters.
Does a hardware wallet stop address poisoning?
A hardware wallet helps when you actually read the address on the device before approving.
Hardware wallets such as Ledger or Trezor are designed to keep private keys away from your internet-connected computer or phone. That is valuable. But if you approve a transaction to the wrong destination, the device will sign the transaction you approved.
MetaMask says it can compare destination addresses against transaction history and show warnings for lookalikes. Trezor says Trezor Suite can blur and mark suspicious poisoning-like transactions as unverified. Etherscan says it hides zero-value transfers by default, labels spoofing addresses, flags or hides zero-value transfers, and tags spoofed tokens. [S4] [S9] [S7]
A 2025 preprint that evaluated 53 Ethereum wallets found uneven protections. Treat that as a study snapshot because wallet products change, but take the lesson seriously: wallet warnings are helpful backup, not a substitute for checking the destination yourself. [S3]
What should you do if you receive dust or a zero-value transfer?
If you receive an unknown dust, zero-value, or fake-token entry, leave it alone and do not copy addresses from it.
You usually cannot stop strangers from sending activity to a public blockchain address. MetaMask says there is no way to stop scammers from sending transactions to a public blockchain address, and Trezor gives similar public-blockchain guidance. [S4] [S9]
In most cases, the practical response is boring: treat suspicious entries as untrusted, hide or ignore them if your wallet supports that, and use verified contacts or original recipient sources for future sends.
Also remember that address poisoning and dusting can overlap. Elliptic distinguishes dusting, which can be used for tracking or deanonymization, from address poisoning, which aims for direct loss through a mistaken send. [S5]
What if you already sent funds to a poisoned address?
Move quickly, document everything, and assume recovery is uncertain.
Write down the transaction hash, network, amount, timestamp, intended recipient address, and actual recipient address. If an exchange, stablecoin issuer, wallet provider, or custodian is involved, contact the relevant support or abuse desk as soon as possible. If the amount is serious, consider reporting the incident through the appropriate law-enforcement or cybercrime channel in your jurisdiction.
On-chain transactions are often irreversible once confirmed. MetaMask warns that lost funds can be irretrievable. Elliptic says recovery may be possible in some cases, but it is far from guaranteed and depends on speed, tracing, and where the funds go. [S4] [S5]
FAQ
Can address poisoning steal my seed phrase?
Address poisoning does not require the attacker to know your seed phrase or private key. The scam works by tricking you into sending funds to the wrong destination. [S4] [S5]
Is checking the first and last characters enough?
No. Attackers can generate addresses that match the visible beginning or ending characters. Check the full address when value matters, especially the middle characters that shortened wallet UIs may hide. [S4] [S8]
Should I still use a test transaction?
Yes, when the amount justifies the extra step. Verify the destination independently for both sends. A test transaction helps most when it confirms the address you already verified. It creates risk if you later copy from a poisoned history row. [S6] [S8] [S5]
The Proof of Tech takeaway
Address poisoning feels obvious after you understand it. Before that, it blends into normal wallet activity.
The attacker is counting on a normal human shortcut: you saw a familiar-looking address before, so you trust it again. Crypto does not forgive that shortcut very well. When you approve and broadcast a transaction, the network will usually process the address you gave it, even if your eyes skipped the middle of the string.
Build the safer habit now. Use verified contacts. Use address books and allowlists. Check the full address on meaningful sends. Use a hardware wallet screen when it matters. Most of all, stop treating transaction history like a trusted address book.
If this helped, save it and share it with someone who moves crypto between exchanges, wallets, and cold storage. One careful check before sending can save a very expensive lesson later.
For more Proof of Tech self-custody thinking, read Bitcoin ownership and responsibility.
Disclaimer: The content on this blog is provided for general informational and educational purposes only and does not constitute financial, investment, legal, or tax advice. Cryptocurrency and Bitcoin investments are highly volatile and involve substantial risk. Mitigate your own risk with your own management practices. Always conduct your own research and consult a qualified professional before making financial decisions. Past performance does not guarantee future results. The author and blog assume no responsibility for losses arising from reliance on this content. Any opinions expressed are the author’s own, and any holdings, sponsorships, or affiliate relationships are disclosed where applicable.
Sources
- USENIX 2025 research paper
- ACM CCS 2024 Ethereum research paper
- 2025 wallet usability preprint
- MetaMask
- Elliptic
- Chainalysis
- Etherscan
- Bitquery
- Trezor
Related reading
Continue with these related Proof of Tech guides: