What is Address Poisoning?

Address poisoning is a newer scam in the crypto market and involves tricking targets into sending crypto to the wrong address. Learn more in our guide.

What are address poisoning scams?

Address poisoning is a deceptive tactic designed to trick users into sending tokens to fraudulent addresses that closely resemble legitimate ones they've previously interacted with. This scam relies on users copying and pasting wallet addresses from their transaction history without closely inspecting them.

Read next: Bitcoin and Crypto Scams

How does address poisoning work?

Crypto wallets use long, complex hexadecimal addresses that are hard to remember. Because of this, most users rely on copying and pasting addresses, a feature supported by wallets like MetaMask. This habit is convenient, but it also opens the door for scams like address poisoning.

Here’s how it generally works step-by-step:

1. You send a normal transaction to a friend or one of your own accounts.

2. A scammer spots the transaction, often using software that monitors popular tokens like stablecoins.

3. They create a vanity address that closely resembles yours (or your recipient’s) using freely available tools.

4. They send a zero-value or negligible transfer from this fake address to your wallet. Now, their address is recorded in your transaction history.

Wallets often shorten addresses, showing only the beginning and end. Most people recognize addresses by these familiar fragments, not by every single character. The scammer’s fake address is crafted to match these parts, making it easy to mistake for a real one.

Later, when you go to copy an address from your history, you might grab the scammer’s lookalike by mistake. If you send real tokens to that address, the funds are lost forever because blockchain transactions can’t be reversed.

Read next: How to Report Stolen Crypto

Types of address poisoning attacks

There are two primary methods scammers use in address poisoning schemes: fake token transfers and zero-value transactions. While the techniques differ, the objective is the same: to mislead users into believing they’ve transacted with an address they trust when they haven’t.

Many wallets and blockchain explorers display a history of token transfers to help users track activity. People often rely on this feature to retrieve addresses for repeat transactions. However, scammers exploit this behavior by inserting deceptive entries that resemble legitimate ones, increasing the risk of users copying the wrong address.

1. Fake tokens

In this variation, attackers deploy a counterfeit token contract using a name identical, or nearly identical, to a well-known token like USDC or USDT. These malicious contracts can be programmed to simulate token transfers, making it appear as though you’ve sent tokens to a specific address even when no real transaction occurred.

Here’s how the scam works:

• The attacker observes legitimate token transfers.

• When they detect a transaction, they issue a transfer of their fake token to the sender’s address, mimicking a genuine transaction.

• As a result, when you check your wallet or block explorer, you may see this fake transaction and mistakenly assume it’s from your own activity.

• If you copy the recipient address from this fake transfer to repeat the transaction, you could unknowingly send real tokens to the scammer’s wallet.

2. Zero-value transfers

Though fake tokens can be spotted by discrepancies like missing token icons, zero-value transfers are harder to detect because they involve real tokens and legitimate contracts.

Here’s what happens:

• Scammers monitor blockchain activity involving popular tokens such as USDC or USDT.

• Instead of using fake tokens, they exploit the transferFrom function of the actual token contract to send a zero-value transfer from your wallet address to an address that looks similar to a previously used one, but belongs to the scammer.

This technique is particularly dangerous because it appears authentic:

• It uses the actual token contract.

• The transaction seems to originate from your address.

• The only difference is that the amount transferred is zero, and the recipient is subtly different.

You might wonder: How can a scammer send a transaction from my address without approval?

The answer lies in how the transferFrom function works. This function is commonly used in DeFi, allowing smart contracts to move tokens on a user’s behalf once approved. However, it doesn’t block zero-value transfers—even when no approval exists—because it only checks whether the transfer amount is less than or equal to the approved amount. If the amount is zero, the check always passes.

Read next: How to Avoid Crypto Scams

How to protect yourself from address poisoning

On public blockchains, anyone can send transactions to your address, including scammers. There’s no way to prevent this. What is within your control is whether you accidentally interact with one of these scam addresses.

Even careful users—those who double-check the beginning and end of an address—can fall for this trick. Awareness and caution are key. Here’s how to stay safe:

• Always verify the full address before sending. Don’t just skim the first or last few characters. Carefully check every character, especially when sending large amounts.

• Avoid copying addresses from transaction history. This includes both your wallet (e.g., MetaMask) and block explorers. If you must copy an address this way, inspect it closely before using it.

• Be cautious even with your own address. If you’re moving funds to your own wallet (e.g., from a centralized exchange), make sure you're copying the correct address, not a poisoned one from a prior transaction

• Use a hardware wallet. These typically require you to confirm destination addresses manually, helping you build a habit of double-checking before approving a transaction.

• Save trusted addresses. In MetaMask, you can use the “Contacts” feature (under Settings) to store frequently used addresses. This helps avoid the need to copy-paste each time.

• Send a small test transfer first. If you’re unsure, consider sending a small amount to confirm the address before sending a larger sum. Just keep in mind that this adds an extra transaction fee.

Koinly can help with your taxes

If you’ve unfortunately been the target of a scam and lost crypto, there may be a small silver lining in your tax bill, as you may be able to claim this as a loss. Learn more in our guide on how to report stolen cryptocurrency on taxes, or sign up for Koinly for free to easily tackle your taxes.