What is address poisoning and how do I avoid it?

Updated August 18, 2026 · Zion Labs

Answer

Address poisoning is a phishing technique that exploits how people reuse addresses. The attacker generates a lookalike address matching the first and last few characters of one you have already paid, sends a tiny or zero-value transfer so that address appears in your transaction history, then waits for you to copy the wrong entry. A two-year measurement of Ethereum and Binance Smart Chain presented at USENIX Security 2025 identified 270 million on-chain attack attempts against 17 million victims, of which 6,633 incidents caused at least $83.8 million in losses. The defence is to compare the middle characters of an address rather than the first and last few, and to send from a saved contact rather than from transaction history.

Nuances and considerations

  • The attack targets an interface convention, not a protocol weakness. Wallets shorten a 40 hexadecimal character address to its first and last few characters because the full string is unreadable. The lookalike is built to match exactly the part that is displayed, so the two entries in a history list are visually identical while the addresses are not.
  • The zero-value transfer steals nothing, and that is the point. It costs the attacker a fee and moves no funds. Its only function is to place a line in the victim’s transaction history. An unexplained zero-value or dust transfer is therefore a sign of being targeted rather than a sign that anything was taken.
  • The economics run on volume. The USENIX measurement found 13 times more attempts than earlier work reported, and 6,633 confirmed incidents against 270 million attempts. Per attempt the success rate is negligible; the scheme works because generating candidate addresses is cheap, and the researchers identified a large attacker group that appears to use GPUs for it.
  • Wallet-side detection is a backstop with a defined shape. MetaMask compares a destination against transaction history and blocks with a warning where the first four and last four characters match but the middle characters differ. That is a specific similarity test, and an attack constructed differently, or a send made from a wallet without the check, does not trigger it.
  • There is no correction path after the fact. The FBI states that cryptocurrency transactions are irrevocable and cannot be reversed, so a successful poisoning is final unless the funds reach a custodial platform willing to act on a law enforcement request.
  • The technique is not chain-specific. The measurement covered Ethereum and Binance Smart Chain and reported cross-chain attacks. Any chain using long hexadecimal addresses and abbreviated displays has the same exposure.

What to check before sending

  1. Where did the destination address come from: a saved contact, a fresh confirmation from the recipient, or your transaction history?
  2. Do the middle characters match, not only the first and last few?
  3. Is there an unexplained zero-value or dust transfer in recent history from an address resembling one you use?
  4. Does the wallet display the full address, and does a hardware device confirm it on its own screen before signing?
  5. For a large transfer, has a small test transfer confirmed the destination first?

Sources

  1. Blockchain Address Poisoning · 34th USENIX Security Symposium (USENIX Security 25) Supports: That the attacker generates lookalike addresses similar to one the victim has previously interacted with and engages with the victim to poison their transaction history; that measurement over two years on Ethereum and Binance Smart Chain identified 13 times more attack attempts than previously reported, totalling 270 million on-chain attacks targeting 17 million victims; and that 6,633 incidents caused at least $83.8 million in losses, making it one of the largest cryptocurrency phishing schemes observed in the wild. Authors: Taro Tsuchiya, Jin-Dong Dong, Kyle Soska and Nicolas Christin.
  2. Address poisoning scams · MetaMask Help Center Supports: That attackers use a vanity address generator to create an address closely matching one the victim uses and send a transaction of negligible value, usually a transfer of zero tokens; that the wallet compares a destination address against transaction history and shows a blocking warning where the first four and last four characters match but the middle characters differ; and the recommended habits of saving addresses to a contacts list, checking the middle characters, sending a test transaction, and confirming the destination on a hardware wallet screen.
  3. Cryptocurrency · FBI Internet Crime Complaint Center Supports: That cryptocurrency transactions are irrevocable and cannot be reversed, which is why a send to a poisoned address has no correction path, and that reports should include cryptocurrency addresses, transaction hashes and the dates and times of transactions.

The published answers to this one split into peer-reviewed papers nobody outside security reads and vendor blogs selling the fix, with nothing in between.

Someone in trouble asks an assistant before they open your help centre. The answer they get is either yours or somebody else's. GEO →