Security & Scams
Crypto Address Poisoning: How to Spot a Look-Alike Wallet
Attackers insert a look-alike wallet into your transaction history, hoping you copy it later. Learn the warning signs, safe address workflow and response after a mistaken send.
Address poisoning is a transaction-history trap. An attacker creates an address whose beginning and ending resemble one you regularly use, then causes a tiny or zero-value transaction involving your wallet. Days later, you copy the familiar-looking address from history and send real funds to the attacker.
The scam does not need your password or seed phrase. It exploits truncated addresses and routine copy-paste behavior.
How the attack reaches your history
Public blockchains reveal addresses and transfers. After observing a useful target, an attacker generates many addresses until one matches visible characters of a trusted destination. They then send dust or create a token event that wallet interfaces may display.
The FBI warning on token impersonation and address poisoning describes the core visual trick: the first and last characters appear familiar while the middle differs.
Why checking six characters is not enough
Wallet apps often shorten 42-character EVM addresses. If you compare only four characters at each end, an attacker can search for a convincing vanity match. The full address is the destination; the shortened label is only a display convenience.
Two addresses can look like this:
- trusted: 0xA14F…8C2D
- attacker: 0xA14F…8C2D
The middle section, hidden by the interface, is different. Blockchain transfers are normally irreversible once confirmed.
A safer address workflow
Use a trusted source of truth instead of transaction history:
- Open the receiving wallet or exchange deposit page directly.
- Copy the current address from that source.
- Confirm asset and blockchain network.
- Compare the entire address or use an approved address-book entry.
- Verify the destination again on the hardware-wallet screen.
- Send a small test transaction.
- Confirm receipt before sending the remainder.
For exchange withdrawals, enable an address whitelist with a cooling-off period where available. A poisoned history entry will not automatically become an approved destination.
Warning signs in the transaction list
| Sign | Why it matters |
|---|---|
| Tiny incoming token or zero-value event | Common way to create a visible history entry |
| Address resembles a frequent recipient | The attacker wants recognition without full verification |
| Unknown token with a familiar symbol | Token name is not proof of contract authenticity |
| Transfer appears without your action | Treat it as untrusted data, not as a payment request |
| Several similar addresses | Automated vanity generation may be targeting your activity |
Do not interact with suspicious tokens to “remove” them. Hiding an item in the wallet interface is safer than signing an unknown contract call.
If you sent funds to the poisoned address
Move quickly, but avoid recovery scammers:
- record the transaction ID, address, asset, network and time;
- notify the sending exchange or wallet provider through official support;
- report the address to relevant blockchain analytics or explorer services;
- file a police or cybercrime report where appropriate;
- monitor the destination for movement;
- secure the remaining wallet if any other compromise is suspected.
An on-chain transfer cannot usually be recalled. Recovery becomes possible only in limited cases, for example if funds reach a cooperative regulated service that can freeze them under lawful process.
Never pay an online stranger who claims they can “hack the funds back.”
Address poisoning versus clipboard malware
Address poisoning places a look-alike in history. Clipboard malware replaces an address as you paste it. The defenses overlap: verify on the signing device and use a test transfer. If the address changes between copy and confirmation, stop and scan the device.
Build a repeatable defense
- Use named address-book entries created from verified sources.
- Require a second person for high-value treasury transfers.
- Display full addresses in wallet settings when possible.
- Separate operational wallets from long-term holdings.
- Review token approvals and account security regularly.
Our account security guide covers 2FA, whitelists and anti-phishing controls, while the USDT network guide prevents network-selection mistakes.
FAQ
Can receiving a dust transaction steal my funds? Not by itself. The main danger is copying the attacker's address or signing a malicious interaction.
Should I create a new wallet? Not merely because a poison transaction appeared. Consider a new wallet if keys, approvals or the device may also be compromised.
Can an exchange reverse the transfer? Usually not once confirmed, but report it immediately in case the destination is identifiable and freezeable.
Security note: never disclose a seed phrase to support, investigators or recovery services.