A new type of crypto scam is draining wallets, and most victims do not realize what happened until it is too late. Address poisoning attacks, which surfaced prominently in March 2023, trick users into sending funds to wallet addresses that look almost identical to their intended recipients. With Bitcoin trading around $28,033 and Ethereum near $1,792, even a single mistaken transaction can result in devastating losses. Understanding how this attack works and how to prevent it is essential knowledge for every crypto user.
The Basics
An address poisoning attack exploits the way most people interact with cryptocurrency wallet addresses. Wallet addresses on Ethereum and similar networks are long strings of characters, typically 42 characters starting with 0x. Because these addresses are nearly impossible to memorize, users typically copy and paste them from their transaction history or address book when sending funds.
Attackers exploit this habit by creating wallet addresses that closely mimic a victim’s frequently used addresses. The fake addresses share the same first few and last few characters as the legitimate address, making them appear identical at a glance. The attacker then sends a tiny amount of cryptocurrency, sometimes zero value, from this fake address to the victim’s wallet. This creates a transaction entry in the victim’s history that looks like it came from their usual contact.
Why It Matters
The danger of address poisoning lies in its subtlety. Unlike phishing scams that require users to click suspicious links or enter credentials on fake websites, address poisoning exploits a behavior that most crypto users consider safe and routine. The attack does not compromise your wallet or private keys. Instead, it manipulates the information you rely on when making transaction decisions.
When the victim later wants to send funds to the legitimate address, they open their transaction history and see the attacker’s poisoned address. Without carefully checking every single character, they copy the fake address and send their funds directly to the attacker. The transaction is irreversible, and because the attacker’s address is valid, there is no mechanism for recovery.
Getting Started Guide
Protecting yourself from address poisoning starts with changing how you handle wallet addresses. The most effective defense is to never copy addresses from your transaction history. Instead, always copy the recipient’s address directly from your address book or contact list, or obtain it from a verified source such as the recipient’s official website or a direct communication channel.
Setting up an address book within your wallet application provides a reliable reference for frequently used addresses. Most modern wallets include this feature, allowing you to save verified addresses with labels. When you need to send funds, select the recipient from your address book rather than searching through transaction history.
For transactions with new recipients, verify the address through multiple channels. Ask the recipient to confirm their address through a separate communication method. If possible, send a small test transaction first and confirm receipt before sending larger amounts.
Common Pitfalls
Many victims fall into predictable traps that make them vulnerable to address poisoning. Relying solely on the first and last few characters of an address for verification is the most common mistake. Attackers specifically design their fake addresses to match these visible portions, knowing that most users do not check the middle characters.
Another pitfall is trusting transaction history entries that appear to come from known contacts. Just because an address appears in your history does not mean it belongs to the same person every time. Address poisoning relies on this assumption to succeed. The Kaspersky report published this week reveals that crypto phishing attacks grew by 40% year-over-year, indicating that attackers are becoming more sophisticated and targeted in their approaches.
Next Steps
Now that you understand the address poisoning threat, take immediate action to secure your transaction practices. Audit your current wallet for any tiny incoming transactions from unfamiliar addresses, as these may indicate poisoning attempts. Set up your wallet’s address book with all frequently used contacts and commit to using it exclusively for address selection. Consider using a hardware wallet with a built-in display that shows the full destination address for confirmation before signing any transaction. These devices provide a critical second verification step that is immune to clipboard manipulation and most software-based attacks.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always verify wallet addresses independently before sending any cryptocurrency.
checking middle characters manually is stone age UX. ethereum is how many years old and this is still the best we have?
Liesl B. 9 years and copying hex strings is still the UX. ENS exists but wallet devs wont make it default because gas fees on mainnet. rolls eyes
almost got hit by this last week. the fake address matched first and last 4 chars of my usual recipient. only caught it because i checked the middle characters manually
the fact that this works because people copy-paste from history is wild. we need better UX defaults in wallets, not just user education
checking the middle chars manually saved you. most people dont bother and thats exactly what attackers count on
checking middle characters manually is the current best defense and its terrible UX. wallets need to implement ENS or contact-based verification by default
ens names solve this completely. 5 dollars a year to never copy paste a hex string again. refusing to use one is just stubborn at this point
ens_or_die_ ENS is 5 dollars a year and people still refuse. the stubbornness of manually copy-pasting 42 character hex strings in 2026 is honestly impressive
ens_or_die_ ENS is 5 dollars a year and people still refuse. the stubbornness of manually copy-pasting 42 character hex strings in 2026 is honestly impressive
Pari D. 5 dollars a year for ENS and people still copy paste 42 hex chars. the friction of being your own bank includes actually using the tools that exist
checksum_dreamer the 30 second GPU thing is why i stopped copy pasting entirely. if your wallet doesnt warn you on first interaction with an address thats a red flag
ens_or_die_ 5 dollars a year and people still refuse. ENS is the single highest ROI security upgrade in all of crypto and it gets ignored
This is why I always verify the full address on my Ledger screen before confirming. Takes 10 extra seconds but saves thousands.
Ledger is fine but even hardware wallets have had firmware exploits. single device verification is still a trust assumption
EIP-55 checksum on Ethereum catches most typos but it doesnt help when the attacker generates a valid checksummed lookalike
EIP-55 was never designed to stop address poisoning. it just catches accidental typos. generating a matching address with valid checksum is trivial for attackers
BTC at 28K and a single mistaken transaction can still wipe you out. address poisoning is the pickpocketting of crypto, low tech but devastating
generating a vanity address with matching first AND last 4 chars takes like 30 seconds on a GPU now. the attack is trivial
malena_r 30 seconds on a GPU to match first and last 4 chars is terrifying. and most wallets still dont warn about it
hex_skeptic_ 30 seconds on a GPU is actually the scary part. wallets shipping without first-transaction warnings for new addresses is negligence at this point
hex_skeptic_ 30 seconds on a GPU is actually the scary part. wallets shipping without first-transaction warnings for new addresses is negligence at this point
30 seconds on a GPU to generate a matching vanity address and people still rely on visual inspection. wallets need forced first-transaction warnings on unknown addresses period
malena_r exactly why EIP-55 is useless here. the checksum passes on the poisoned address too
Rabby wallet shows a warning when the address has no prior transaction history. caught a poisoning attempt for me last month
Rabby caught a poisoning attempt for me too. that first-transaction warning should be standard on every wallet period
hardware wallet + ENS + double check on device screen. three layers of protection and i still triple check. paranoia is the correct default state in crypto