Address poisoning: the lookalike address that drains you

You are about to send crypto to an address you have used a dozen times. You open your wallet, tap "recent recipients," and there it is at the top of the list: an address that starts 0x7a3f and ends 9c2b, exactly like your exchange deposit address. One tap fills the field. You hit send. Minutes later the money is gone, and it is never coming back.

That is address poisoning, and it is one of the quietest, cruelest scams in crypto because it does not rely on a fake website, a stolen password, or a leaked seed phrase. It relies on a single lazy habit that almost everyone has: copying a destination address from your own history instead of typing or verifying the whole thing. The attacker does not break into anything. They just plant a decoy where they know you will reach for it, and then wait for your muscle memory to do the rest.

In May 2024, one holder nearly lost $68 million in wrapped Bitcoin this exact way (CoinDesk). This post breaks down how the trick works, why it keeps landing, and the three habits that make you immune to it.

TL;DR

• Address poisoning seeds a lookalike address into your transaction history via a zero-value or fake-token transfer, so you later copy the wrong one and pay the attacker instead of your real recipient.
• The decoy is engineered to match the first and last characters of an address you actually use. Those are the only characters most people check — which is the whole point.
• In May 2024 a whale nearly lost $68M in WBTC to this attack; the funds were later returned after negotiation, but that is a freak exception, not the norm (CoinDesk).
• Chainalysis traced a single poisoning campaign to more than 82,000 addresses, of which only 22 ever received over $1 — a spray-and-pray game that pays off on rare big hits (Chainalysis).
• Three defenses beat it completely: never copy a send-to address from history or autofill, verify the full string on your hardware wallet's own screen, and send a small test transfer first.

What is address poisoning and how does the attack work?

Address poisoning is a scam that tricks you into copying an attacker's address out of your own transaction history by making it look almost identical to an address you trust. Nothing is hacked. The attacker simply contaminates the one place you look when you are moving money in a hurry.

Here is the mechanic step by step. Crypto addresses are long, random-looking strings — 42 characters on Ethereum. Nobody reads all 42. Instead, wallets and block explorers shorten them to something like 0x7a3f…9c2b, showing only the first four and last four characters. Everyone has quietly agreed to verify addresses by those ends. Attackers know this.

So the attacker generates a vanity address whose first and last characters match an address you regularly send to. This takes computing power but is entirely feasible for the ends alone. Then they "poison" your history: they send you a transaction from that lookalike address so it appears in your recent activity. Usually this is a zero-value transfer, or a fake token designed to mimic a real one — enough to land the decoy in your list without costing them anything real.

Now the trap is set. The next time you go to pay your real recipient, your history shows two entries that both read 0x7a3f…9c2b. You copy the top one, because it is right there and it matches. The middle twelve characters — the part you never look at — belong to the attacker. You send, the transaction confirms on-chain, and there is no undo. This is a form of phishing, except the bait is planted inside your own wallet rather than in your inbox.

How much has address poisoning actually stolen?

The headline case is the May 2024 WBTC attack, where a holder sent roughly $68 million in wrapped Bitcoin to a poisoned lookalike address (CoinDesk). The victim had made a legitimate transfer, and the attacker's decoy — matched at both ends — sat one line away in their history. They copied the wrong one.

That case is famous for its ending, not just its size: after on-chain negotiation, the attacker returned about 96% of the funds — roughly 22,960 ETH — to the victim (Cointelegraph). Do not read that as reassurance. Getting your money back after a poisoning attack is astronomically rare and happened here only because the sum was large enough to make a public negotiation worthwhile. For a normal-sized transfer, the money is simply gone.

The scale underneath that one headline is the scarier part. Chainalysis traced a single address-poisoning campaign to more than 82,000 distinct addresses, and found that only 22 of them ever received more than $1 (Chainalysis). That tells you exactly what kind of attack this is: cheap, automated, and sprayed across tens of thousands of wallets in the hope that a handful of people copy the wrong string on a big transfer. You do not have to be a target. You just have to be one of the thousands who got dusted, on the wrong day, in a hurry.

Why does verifying the first and last characters fail?

Checking the ends fails because the ends are precisely what the attacker copies. When you glance at 0x7a3f…9c2b and think "yes, that's mine," you are running the exact check the attack was built to pass. The mismatch lives in the middle — the characters your wallet hides and your eyes skip.

This is why "just be careful" is useless advice here. Careful people get hit, because the human verification method itself is broken. The address is too long to read, so everyone shortcuts to the ends, and the whole scam is designed around that shortcut. The fix is not to look harder at the ends. The fix is to stop trusting the shortened form and stop trusting your history at all.

That is also why address poisoning is a cousin of clipboard hijacking — malware that silently swaps an address you copied for the attacker's before you paste it. Both attacks exploit the same weak point: the moment between choosing a recipient and confirming it, when you are relying on a quick visual match instead of the full string. Beat that moment and you beat both. (Wallet-drainer scams attack a different weak point — a malicious signature — which we cover in wallet drainers explained.)

How do I protect myself from address poisoning?

Three habits make you effectively immune, and none of them require any special tooling.

1. Never copy a destination address from your history or autofill. This is the single most important rule, and it has no exceptions. Your transaction history is the exact surface poisoning contaminates, so treat it as untrusted for the purpose of choosing recipients. Instead, keep a saved address book — a list of labeled addresses you added yourself, once, after verifying them — and pull recipients only from there. An address book entry is a source you control; your history is a source the attacker can write to.

2. Verify the full address on your hardware wallet's own screen. A hardware wallet displays the complete destination on a screen that malware on your computer cannot alter. Read the whole string — beginning, middle, and end — against your address book before you approve. If the middle does not match, cancel. This is the check that actually works, because it reads the twelve characters the attack depends on you ignoring.

3. Send a small test transfer first. For any large or unfamiliar send, move a tiny amount first, confirm it arrives at the right place, and only then send the rest. A test transfer costs you a little gas and turns a potential six-figure mistake into a rounding error. This is standard practice among people who move serious money, and it exists precisely because irreversibility is the defining feature of self-custody: there is no bank to call and no charge to reverse.

Put together, these are muscle memory you build once. The Address Poisoning drill walks you through a poisoned send screen so you can feel the pull of that top history entry — and practice refusing it — before it ever costs you anything real.

Related questions

Does address poisoning steal my seed phrase or private keys? No, and that is what makes it so sneaky. Address poisoning never touches your secrets. You send the money yourself, with your own keys, to an address you chose — you were just tricked into choosing the attacker's lookalike. Because nothing was "stolen" in the traditional sense, none of the usual seed-phrase warnings apply, which is why people who consider themselves security-savvy still fall for it.

Can I get my money back after an address poisoning attack? Almost never. On-chain transfers are permanent and there is no authority that can reverse them. The famous $68M WBTC case ended with the funds returned only because the sum was huge enough to justify a public negotiation, and even then it was the attacker's choice. Treat that outcome as a lottery win, not a safety net. Prevention is the only reliable protection.

Why did the attacker send me a token or a zero-value transfer I never asked for? To plant their lookalike address in your history. A zero-value transfer, or a fake token that mimics a real one, costs the attacker almost nothing and appears in your recent activity, seeding the decoy where you will later reach for it. If you see an unexpected transfer from an address that suspiciously resembles one you use, that is the poisoning attempt itself — do not interact with it, and never copy that address.

Is address poisoning the same as a wallet drainer? No. Address poisoning tricks you into sending funds to the wrong address by copying a lookalike from your history. A wallet drainer tricks you into signing a malicious approval that lets a contract move your tokens later. They are different attacks with different defenses, though both exploit a rushed, un-verified action. See wallet drainers explained and approval phishing for the signature-based side of the family.

How common is this compared to other crypto scams? Very common, because it is cheap and automated. A single campaign touched over 82,000 addresses according to Chainalysis, and poisoning attempts are sprayed across active wallets constantly. It sits alongside the other patterns in our roundup of common crypto scams and in the bigger picture of how Web3 users actually get hacked — the throughline being that the attacker is exploiting a human reflex, not a code flaw.