Address Poisoning: The Scam in Your Transaction History
An attacker plants a transfer from a lookalike address so a later copy-paste from history sends funds to them. Verify the middle, never the ends.
Address poisoning is unusual among crypto attacks because it requires no compromise of anything. Nothing is hacked, no key is stolen, and no permission is granted. The attacker simply arranges for a plausible-looking address to appear where you are likely to copy one.
How the Attack Is Built
Addresses are long strings that no one reads in full. Every wallet, explorer and interface truncates them, showing a handful of characters at each end with the middle elided.
An attacker generates addresses until one matches the first few and last few characters of an address you use. That is computationally feasible for the short prefixes and suffixes that interfaces display, which is the whole basis of the attack.
They then send a transaction from that address to yours, usually of negligible value or a worthless token. The point is not the transfer. The point is that the transaction now appears in your history, with an address that looks, at a glance, exactly like one you have used before.
The Moment It Works
Some time later you want to repeat a payment. Rather than looking up the address, you scroll your transaction history to where you sent funds before and copy the address from there.
If you take the attacker’s entry, the funds go to them. The transaction is valid, signed by you, and irreversible.
The attack targets a habit rather than a vulnerability. It works on careful people because the habit feels careful: reusing an address you have used before seems safer than typing a new one.
The Defence
Never source an address from transaction history. This single rule removes the attack entirely.
Use an address book entry in your wallet, saved once from a verified source. Use the address given directly by the recipient. For a service, use the deposit address shown in your account on that service.
Verify the middle, not the ends. When checking an address, read characters from the centre of the string. The ends are what an attacker can match; the middle is what they cannot.
Send a test transfer first for any significant amount to a new destination. The cost is a fee and a few minutes, and it confirms the funds arrive where you intended.
Read the hardware wallet screen. A signing device displays the destination and asks for confirmation specifically so this class of mistake is caught. Approving without reading gives up that protection; see verify before signing.
| Habit | Risk | Better |
|---|---|---|
| Copy from transaction history | High, this is the target | Saved contact or direct from recipient |
| Check first and last four characters | High, those are matchable | Verify characters from the middle |
| Approve on the device without reading | High | Read the destination on the screen |
| Large transfer to a new address, no test | Moderate | Small test transfer first |
| Saved address book entry, verified once | Low | Keep it and use it |
The Dust That Arrives
Receiving an unsolicited tiny transfer, sometimes called dusting, is what makes the attack visible. It is not itself harmful to receive.
Two things are worth not doing with it. Do not send it anywhere as part of consolidating balances, because spending it links addresses together in ways that reduce your privacy. And do not interact with any token that arrives unsolicited, because worthless tokens are sometimes used to lure a visit to a site that asks for a signature or a permission.
Most wallets allow hiding or marking such entries. Hiding them reduces the chance of one being mistaken for a legitimate transaction later.
Why Interfaces Make This Hard
The underlying problem is that addresses are not human-readable and interfaces compensate by truncating them. Every design that shows fewer characters improves the display and enlarges the attack surface.
Some wallets now warn when a destination closely resembles a previously used address, which is a genuine improvement. Name services that map a readable name to an address remove the copying step entirely for destinations that have one, though the registration of such a name is its own thing to verify.
Neither removes the need for the habit. The address book is under your control; the interface is not.
What People Get Wrong About This
The first mistake is believing the dust transfer itself did something. It did not; it is bait.
The second is checking only the visible characters. Those are precisely what the attacker matched.
A third is trusting transaction history as a source of addresses. It is a record of what happened, including things done to you.
A fourth is approving a hardware wallet prompt without reading it, which turns a device bought for this exact protection into a slower way to sign.
And the last is assuming small amounts do not matter. The test is not the size of the dust; it is the size of the transfer you later make to the wrong place.
Related Habits
The same discipline covers a family of attacks: read what you are signing, verify the destination on a device you control, and treat anything that arrives unsolicited as untrusted. See crypto phishing and wallet drainers for the other members of that family.
Common questions
What is address poisoning?
An attacker generates an address whose first and last characters match one you use, then sends a tiny transfer so it appears in your transaction history. Later, when you copy an address from that history to repeat a payment, you may take theirs instead of yours, because the visible parts match.
Why does it work?
Because almost every interface truncates addresses, showing the first few and last few characters with the middle hidden. People verify what they can see. An attacker can generate an address matching those visible ends in a reasonable amount of computation, so the parts you check are exactly the parts they controlled.
Is receiving a tiny unexpected transfer dangerous by itself?
Receiving it does nothing. The danger is entirely in what you do next. The transfer exists to place the attacker's address in your history where you might copy it. Ignoring it costs nothing, and interacting with any token it delivered is a separate risk worth avoiding.
How do I avoid it?
Never source an address from transaction history. Use a saved contact in your wallet, or the address from the recipient themselves, and verify the middle characters rather than only the ends. A small test transfer before a large one confirms the destination.
Does a hardware wallet protect against this?
Only if you read its screen. The device shows the destination address and asks you to confirm it, which is exactly the check that catches this. Approving without reading defeats the protection, and that is what the attack relies on.
Read next
- How Crypto Phishing Works: Attack Vectors and Defenses Learn how crypto phishing attacks operate, from fake wallet sites to malicious airdrops, and how to protect your keys and signatures.
- Dusting Attacks: Unsolicited Funds and Tokens Dusting attacks send tiny amounts or tokens to your address. Learn how they work, why receiving is not theft, and how to respond safely.
- Crypto Recovery Scams: How the Second Theft Works How crypto recovery scams target people who already lost funds: the upfront fee, the fake investigator, the unlock payment, and what real reporting routes can do.
- Crypto Wallet Addresses: Formats and Cross-Chain Risks Understand crypto wallet address formats across chains, why the same address differs by network, and how to avoid sending funds to the wrong network.
- Stuck Crypto Transactions: Causes and Fixes Learn why crypto transactions get stuck, how nonces work, and how to speed up or cancel a pending transaction. Understand the risks and what not to do.