Address Poisoning Attacks and How to Avoid Them

Address poisoning is a scam that relies on a small habit: copying a recipient address from your own transaction history. Attackers send tiny or zero-value transfers from addresses designed to look like ones you use. When you later copy what seems to be your usual address, you paste the attacker's instead and send funds to them.

It sounds unlikely until you see how closely the addresses match.

How the attack works

The sequence usually goes like this:

1. You send stablecoins to a regular address, such as an exchange deposit or a colleague
2. An attacker watches the chain and generates an address that starts and ends with the same characters
3. The attacker sends a tiny transfer, or a fake token transfer, from that lookalike address to you
4. The lookalike now appears in your wallet history next to the real transaction
5. Next time, you copy the recipient from history and paste the attacker's address

Because most wallets and explorers shorten addresses to the first and last few characters, the two entries look identical at a glance.

Why it works

Ethereum addresses are long, and people rarely read them fully. Checking the first four and last four characters became a common shortcut. Attackers can cheaply generate addresses that match those characters, which turns the shortcut into a weakness.

Fake token transfers make it worse. Some attacks use fake token contracts that emit transfer events showing your address sending tokens to the attacker, so the poisoned address even appears as something you sent to.

How to protect yourself

These habits prevent address poisoning:

• Never copy recipient addresses from transaction history
• Save frequent recipients in your wallet's address book, after verifying them once carefully
• Verify more than the first and last characters, including a section from the middle
• Send a small test transfer to new recipients and confirm receipt through another channel
• Hide or ignore zero-value and unknown token transfers in your wallet

For business payments, keep an internal list of verified addresses and require a second person to check large transfers.

Signs your history has been poisoned

Sign	What it means
Zero-value transfers from unknown addresses	Poisoning attempt
Tiny transfers of a token you hold, from lookalike addresses	Poisoning attempt
Transfers of tokens with familiar names from unfamiliar contracts	Fake tokens used for poisoning
Outgoing transfers you do not remember making	Fake token events, check the contract

Receiving poisoning transfers does not mean your wallet is compromised. The attacker cannot move your funds. The danger is only that you copy the wrong address later.

What wallets and apps can do

Some wallets now warn when an address closely resembles one in your history or address book, and some hide zero-value transfers by default. Checkout pages can help too, by showing the full address in a readable format, offering copy buttons that copy from the page itself, and providing QR codes so customers do not rely on history.

If you already sent funds to a poisoned address

Transfers on public blockchains cannot be reversed. Report the address to the exchange if the funds went to one, report the incident to your wallet provider, and document the transaction in case law enforcement or the token issuer can help. Stablecoin issuers occasionally freeze stolen funds, but recovery is uncommon.

When paying any merchant, copy the address from their official page every time. Proud Globe order pages, for example, show the full receiving address with a copy button and a QR code, so there is never a reason to reuse an address from history when you claim a tile.