Address poisoning, explained

Address poisoning is a low-effort, high-patience attack that does not touch your keys, your approvals, or any contract you interact with. It manipulates one thing: your transaction history. By planting a lookalike address there, the attacker hopes you will copy it by mistake the next time you send funds. The theft, when it happens, is entirely your own transaction, sent to the wrong place.

How the attack is seeded

The attacker first generates an address that closely resembles one you use or send to often. Because most people verify only the first few and last few characters of an address, an address that matches those ends looks convincing at a glance, even though the middle differs entirely. The attacker then places that lookalike into your history using one of two techniques:

• Zero-value transfers. The attacker sends a transfer of zero tokens from the lookalike address, or crafts an event that makes it appear you transacted with it. This costs only gas and risks nothing for the attacker, which is why it is the dominant method. Your wallet or explorer records an interaction with the lookalike address.
• Fake or worthless tokens. The attacker sends a token engineered to display a familiar name or symbol, such as something imitating a well-known stablecoin, from the lookalike address. The transfer looks like a normal receipt of a recognizable asset, seeding the address in your history with a veneer of legitimacy.

Either way, nothing has been stolen yet. The attacker has simply left bait in a place you trust: your own list of recent transactions.

The copy-paste trap

The payoff comes later, when you go to send funds. A very common habit is to find a recent transaction, copy the counterparty address from your history, and paste it as the recipient. If you copy the poisoned lookalike instead of the real address, you approve and broadcast a normal, valid transaction that sends your funds straight to the attacker. Your wallet does nothing wrong; the signature is legitimate; the address is simply not the one you intended.

A related risk is clipboard tampering by malware, which is a separate but complementary threat: some malicious software watches your clipboard and silently replaces a copied crypto address with the attacker’s. Whether the substitution comes from your poisoned history or from clipboard malware, the failure mode is identical: you paste an address that is not the one you meant to use, and confirm it because the ends look right.

Why partial verification fails

Addresses are long and unmemorable by design, so wallets and users abbreviate them, showing something like the first six and last four characters. Attackers exploit exactly this. Generating an address whose first and last characters match a target is feasible, so a side-by-side glance at the truncated forms can look identical while the full addresses are completely different. Verifying only the ends is not verification; it is pattern-matching the very part the attacker optimized to fool.

What explorers and wallets do, and do not, do

Some tooling has adapted. Etherscan began hiding zero-value token transfers by default in April 2023 to reduce the visibility of poisoning bait, and various wallets now flag or filter suspicious spam transfers and mark unfamiliar addresses. These help, but coverage is inconsistent: many explorers and wallet interfaces still surface zero-value and spam transfers, and a filtered display does not remove the underlying transactions from the chain. You cannot rely on your interface to have scrubbed every piece of bait.

Defense: never source an address from history

The single most effective defense is to break the habit the attack depends on. Do not copy recipient addresses from your transaction history. Instead:

• Use a saved address book. Save addresses you send to as named contacts, verified once at the time you add them, and always select the recipient from that book rather than from recent activity. This is the defense wallet makers and hardware vendors consistently recommend.
• Verify the full address, not the ends. When you must handle a raw address, check the entire string, or at minimum several characters across the middle as well as both ends. Matching ends prove nothing.
• Send a small test first for large or new transfers. For a significant amount to a new destination, send a small amount, confirm it arrived at the correct address, then send the rest.
• Confirm on the device screen. If you use a hardware wallet, verify the recipient address on the device’s own display, which reflects the transaction being signed rather than what a possibly-tampered clipboard or page shows.
• Treat unexpected token receipts as suspicious. An unsolicited token, especially one imitating a familiar asset, or a zero-value transfer from an address resembling one you know, is a signal that you may be a poisoning target. Do not interact with it and do not copy its address.
• Guard against clipboard malware. Keep your device clean, and always re-read the recipient after pasting, because malware that swaps a copied address relies on you not looking again before you confirm.

A note on mobile and QR codes

The attack is, if anything, easier on mobile, where screens are small and addresses are truncated even more aggressively. On a phone it is tempting to tap a recent transaction and reuse the counterparty address, which is exactly the poisoned path. Prefer scanning a QR code provided by the genuine recipient over copying text, and when you scan, still confirm the decoded address against a trusted source before sending. QR codes are not immune either: a code shown on a compromised screen or in a tampered image can encode an attacker’s address, so treat the decoded result as an address to verify, not as automatically correct. On any platform, the recipient shown at the final confirmation step is the one that matters, so read it there rather than trusting an earlier field you filled in.

Why this attack persists

Address poisoning endures because it is cheap, requires no exploit, and targets human habit rather than software. There is nothing to patch in your wallet, because your wallet is behaving correctly; the vulnerable component is the shortcut of trusting recent history and truncated addresses. That is also good news: the defense costs nothing and needs no special tools. Maintain a verified address book, select recipients from it, and verify the full address on a trusted screen before you confirm. Do that consistently and the bait sitting in your history is harmless, because you will never copy from it.

Sources

• MetaMask Help Center — Address poisoning scams
• Ledger Academy — What Are Address Poisoning Attacks and How to Avoid Them
• Trezor — What are address poisoning attacks and how to avoid them