Address Poisoning Scam: How It Works and the Fix

Address poisoning is a scam in which an attacker sends you a tiny or worthless transaction from an address that looks almost identical to one you use, so the fake address appears in your history and you copy it by mistake the next time you pay. A two-year study of Ethereum and BNB Smart Chain found over 270 million such attempts and 6,633 successful transfers worth more than 83.8 million US dollars. The fix is a habit: never copy a destination from your transaction history, and compare the whole address.

How the scam works, step by step

The following is an illustration with invented values, but each step reflects the mechanism described in the research and in wallet vendors' own warnings.

1.You make a normal payment. You send 5,000 USDC to a person or an exchange deposit address you use. The transaction is recorded on-chain and appears in your wallet's history with the recipient's shortened address, for example 0x5f3a...c91d.

2.The attacker is watching. Blockchains are public, so attackers monitor outgoing payments from valuable wallets. They see your payment.

3.They generate a lookalike. The attacker computes addresses until one begins and ends with the same characters as the recipient's, such as 0x5f3a...c91d, with a different middle. The address is a valid account that the attacker controls.

4.They send you something small. The lookalike sends you a trivial transaction, such as a zero-value transfer, a dust amount or a worthless token that imitates USDC. Now your history contains an entry that looks like your recent payment.

5.You pay again and copy from history. Days or weeks later you need to pay the same person. It is faster to copy the address from your history than to find the original. You copy the lookalike. The first and last characters match what you remember, so it passes a glance.

6.The payment goes to the attacker. On-chain payments settle and cannot be reversed by the network.

Trezor describes the same pattern: scammers create a vanity address that closely resembles one you have used, place it in your transaction history, and hope you copy it by mistake. Its support article says the attack cannot drain a wallet on its own, and that one transaction to the wrong address can cause the loss. Nothing is taken from your wallet by the poison transaction itself. You send the funds yourself.

Why matching a few characters is cheap and matching all of them is not

An Ethereum address is 40 hexadecimal characters after the 0x. Each position has 16 possible values. To find an address whose first and last characters match a target, an attacker generates random addresses and keeps the ones that match. The expected number of tries to match n specific characters is 16 to the power of n.

The table shows the expected work, assuming a graphics processor generating 516 million candidate addresses per second, the benchmark the study authors report for a GPU running the Profanity2 tool. The times are arithmetic on that single figure, not measurements of any attacker.

Characters the attacker must match	Expected tries (16 to the n)	Time on one GPU at 516M per second
6	about 16.8 million	under 0.1 second
7 (3 at the start, 4 at the end)	about 268 million	about 0.5 second
8 (4 at the start, 4 at the end)	about 4.3 billion	about 8 seconds
10	about 1.1 trillion	about 35 minutes
12	about 281 trillion	about 6 days
14	about 72 quadrillion	about 4.4 years
16	about 1.8 times 10 to the 19th	about 1,100 years
40 (the full address)	about 1.5 times 10 to the 48th	about 9 times 10 to the 31st years

Three observations follow.

The shown characters are cheap. A wallet that displays four characters at each end exposes an 8-character match, which takes seconds. The detection system in the study flagged lookalikes sharing at least 3 starting and 4 ending characters.

Each extra character multiplies the work by 16. The study notes that most attack groups produced addresses matching at most about 14 hexadecimal digits, and one group reached up to 20 matching digits, which required orders of magnitude more computation and likely GPUs. The study estimated that group's cost at about 1.7 million dollars against profits of about 4 million.

The full address cannot be faked. Matching all 40 characters means finding someone else's key by brute force, which is not feasible. That is why comparing the entire address, not the shortened display, defeats the attack.

The checksum capital letters do not help

Many Ethereum addresses are written with mixed upper and lower case letters. That is the EIP-55 checksum. The specification derives the capitalization from a hash of the address, and it exists to catch typing mistakes. Its own rationale puts the chance that a randomly mistyped address passes the check at 0.0247 percent. A lookalike generated by an attacker is a fully valid address with a valid checksum of its own, so the capitalization gives no signal that it is the wrong address. It protects against typos, not against a deliberate substitute.

The three variants

The study counted three ways attackers place the poisoned entry in your history. Counts are the transfers recorded for the whole two-year window on Ethereum and BNB Smart Chain.

Variant	What the attacker sends	Why it appears in your history	Count in the study
Zero-value transfer	A token transfer of zero amount, made by calling the token contract's transferFrom function with your address as the source	The transfer event names your address and the lookalike, so wallets and block explorers list it	147,742,203
Counterfeit-token transfer	A small amount of a worthless token that imitates USDC or USDT	It looks like a real stablecoin transfer in the history	118,367,370
Tiny (dust) transfer	A very small real amount of the native coin or a token, such as a fraction of a cent	A genuine incoming transfer from the lookalike	3,959,896

Trezor's article lists the same families: worthless tokens that imitate popular ones such as USDC or USDT, and fake transfers with amounts that match a legitimate transaction. The zero-value variant is the most common in the study. The authors note that a protocol-level fix to zero-value transfers was opposed by the community because it would break existing code.

On BNB Smart Chain, where fees are low, attackers sent far more attempts (about 252.7 million) for far less money recovered (about 4.5 million dollars). On Ethereum there were about 17.3 million attempts, 1,738 successful transfers from 1,502 victims, and about 79.3 million dollars. The study's largest single captured Ethereum payoff was about 20 million dollars, and it describes a separate case of about 1,155 WBTC, about 68 million dollars, that its detector missed and excluded from the totals.

When the attack works, according to the research

The authors looked at which lookalikes got paid. Their findings are useful because they describe your risk.

More similar and earlier tends to win. Victims were more likely to pick a lookalike that was more similar to the intended address or that appeared earlier in the history, though the relationship is not strictly linear.

Attackers compete. In 79 percent of successful Ethereum attacks, more than one lookalike had targeted the same victim.

Rich, active wallets are targeted. One group mostly targeted accounts holding more than 10,000 dollars in stablecoins.

Defenders can act after the fact. The paper reports that Tether blocked one attacker address within about an hour. That is one case, not a promise about the response to any report.

The practical lesson is that the people most at risk are those who make frequent payments to the same few addresses by copying from history, and who hold enough to be worth targeting.

Who runs it: the study's attack groups, their costs and their takings

The Carnegie Mellon authors did not only count transfers. They clustered the lookalike addresses into groups using shared contracts, shared infrastructure and shared behavior, and found 49 groups with more than one lookalike address, accounting for 97.4 percent of poisoning transactions. Eight groups on Ethereum are large enough to profile. Table 5 of the paper reports each one's revenue (the phished amount), cost (the value of any tiny transfers sent plus transaction fees) and profit. Address-generation cost is handled separately in the paper.

Group	Successful attacks	Revenue	Cost	Profit	Revenue per dollar of cost
1	440	$12,494,248	$8,368,313	$4,125,935	1.5
2	363	$29,043,402	$2,704,455	$26,338,947	10.7
3	277	$9,415,636	$2,546,143	$6,869,493	3.7
4	109	$1,187,927	$504,628	$683,299	2.4
5	48	$4,837,606	$202,868	$4,634,738	23.8
6	125	$9,023,888	$682,016	$8,341,871	13.2
7	156	$4,572,499	$226,418	$4,346,081	20.2
8	7	$103,417	$68,123	$35,294	1.5
Top eight	1,525	$70,678,623	$15,302,964	$55,375,658	4.6

The top eight groups account for 1,525 of the 1,738 successful Ethereum transfers and about 89 percent of the $79.3 million captured on that chain. The last column is our division of the paper's figures.

What the table says about the economics:

Margins differ by an order of magnitude. Group 1 sent real small amounts to victims as bait (the only group to use tiny transfers) and spent over $8 million, earning $1.5 for each dollar. Group 5 spent about $203,000 and took $4.8 million. A method that costs less per attempt, such as zero-value transfers with no value attached, leaves more of each payoff as profit.

Skill is not the same as profit. Group 1 also produced lookalikes matching up to 20 digits, far beyond the roughly 14 digits most groups reached. The paper's cost column leaves out address-generation computing, so the margins in the table overstate the true margin of any group, most of all Group 1.

The groups compete. In the paper's win-loss comparison the top seven groups hover around 50 percent against each other, and they mostly win against smaller groups. Because 79 percent of successful Ethereum attacks had more than one lookalike aimed at the same victim, a payoff goes to whichever lookalike the victim happened to pick.

No sanctioned entity appears. The authors report that none of the attack instances traced to an address on the US Treasury's sanctions list. The paper's picture is of profit-seeking crime groups, not of sanctioned actors.

How targets are chosen

The poisoning transfer typically lands within 20 minutes of the victim's genuine payment, which implies that attackers watch the chain for payments from valuable accounts and react. The authors sampled 1,000 victims from each of the top seven groups, looked up their stablecoin balance just before the first poisoning transfer, and compared them with 1,000 randomly chosen USDT users. Every group's targets held significantly more than the baseline, and for Group 6 most victims held over $10,000. The authors also report 83 payoff transfers above $100,000. Across a larger sample of 100,000 accounts, the number of attacks an address received rose with how often it made transfers (Spearman's rank correlation of 0.7) and with the size of its largest transfer (0.45).

Two details cut against the popular picture of the scam. The addresses attackers imitate most are exchange hot wallets, such as those of Coinbase, Binance and Bybit, because those are among the most active accounts. The authors found no successful attack involving them, since ordinary users rarely send to a hot wallet directly, and they call this effort wasted. And the scam crosses chains: attackers reused 16,903 lookalike addresses across Ethereum and BNB Smart Chain and targeted the same 107,542 victims on both, because an EVM address is the same on every EVM chain.

The first attack groups appeared in December 2022, and the paper notes several of the top groups stopped around May 2024 on Ethereum while activity on BNB Smart Chain jumped in June 2024. The study could not confirm an early-mover advantage: later entrants were still profitable.

A copy-and-verify routine that defeats it

Nothing here requires special software. The routine is a set of habits, listed in the order to apply them.

1.Never copy an address from your transaction history or from a block explorer's list of transfers. Trezor's guidance is explicit: do not copy the destination address from the transaction history, including your own address when moving funds from an exchange.

2.Copy from the source of truth. Take the address from the place where the recipient shows it: the exchange's deposit page, the invoice, or a message you can verify through another channel. For your own wallet, use its receive screen.

3.Compare the whole address, not the ends. Check every character, ideally in groups, on the screen of a hardware wallet if you use one. Trezor's article says the only way to ensure safety is to carefully check every character.

4.Use an address book or allow-list. Save verified addresses once, from the source of truth, and pay from the saved entry. Exchanges that offer withdrawal allow-lists let you restrict withdrawals to saved addresses.

5.Send a small test first. Trezor suggests a small test transaction, noting that it means paying the network fee twice. For a large payment the extra fee is small against the risk. Check that the test arrived at the right place before sending the rest.

6.Treat unexpected incoming transactions as noise. An unexplained incoming transfer, especially of zero value or of a token you did not ask for, is a warning sign. Do not interact with it and do not copy its sender.

7.Be suspicious of speed. The attack works because copying from history is quick. A moment of friction is what stops it.

Our guide to withdrawing from an exchange to self-custody describes the test-send step in detail, and the crypto scam red-flags checklist covers other ways a payment can be diverted. For a worthless token that shows up in your wallet, see the token approvals guide, since interacting with it adds a separate permissions risk. More wallet-safety pages are in the self-custody and security topic hub.

What wallets can and cannot do

Wallet makers have started to add warnings. Trezor Suite has a filter that checks whether incoming tokens share characteristics with those used in address poisoning, blurs suspicious entries in the history and marks them unverified. Trezor says a feature to hide these transactions is still being developed, and tells users in the meantime to ignore them. Ledger's academy article describes the attack and lists defenses including rotating addresses, using hardware or multisig wallets, whitelisting trusted contacts and using blockchain analytics; the details of any in-product protection were not confirmed for this page.

The study's authors recommend wallet-level changes, such as showing more of each address, hiding suspected poisoning transfers from history, or asking for confirmation before sending to an address that resembles one seen before. Until every wallet does that, the user's routine is the control that works everywhere.

What does not help

Checking only the first and last characters. That is exactly what the attacker matches.

Trusting the checksum capitalization. A lookalike has its own valid checksum.

Assuming a hardware wallet prevents it. A hardware wallet shows the full address for you to verify, but it cannot tell you which address you meant. If you approve the wrong one, it signs it.

Assuming a familiar-looking history entry is yours. The entry is created by the attacker.

Which chains are affected

The study measured Ethereum and BNB Smart Chain, and Trezor's article names Ethereum and EVM chains such as Polygon and BNB Smart Chain as targets. Chains with low transaction fees are cheaper to attack at scale, which is why BNB Smart Chain saw the most attempts. The same copy-from-history mistake could in principle happen on any chain whose wallets display shortened addresses, but the sources read for this page do not measure Bitcoin or other networks, so no figures are given for them. The habits above apply everywhere.

If you already sent funds to a lookalike

The sources support honesty here, so this section does not promise recovery.

Stop and record. Save the transaction hash, both addresses, the amount, the date and the wallet you used. Do not send more funds to "test" the address.

Report through official channels. Our guide on how to report a crypto scam lists the agency for each country. In the United States the FBI's Internet Crime Complaint Center takes reports; in Canada the Canadian Anti-Fraud Centre does. A report creates a record and may help investigators; it does not guarantee a result.

Contact the platform that holds the destination, if there is one. If the lookalike belongs to a regulated exchange, that exchange can be told through its own support channel. A normal attacker address is a private wallet, so this usually does not apply.

Know that some tokens can be frozen. The study found one case where Tether blocked an attacker address within about an hour. Stablecoin issuers can freeze balances at an address, as our explanation of whether Tether or Circle can freeze stablecoins shows, but that depends on the token, the speed of the report and the issuer's decision, and nothing guarantees it.

Do not hire anyone who promises to get the money back. People who contact victims offering recovery for a fee are usually running a second scam. The recovery scams guide explains the pattern, and no genuine agency asks for payment to recover funds.

The odds and the stakes, from the study's totals

Simple division on the study's headline figures puts the scale in proportion. These are our calculations from the paper's totals.

Measure	Calculation	Result
Success rate per attempt, both chains	6,633 divided by roughly 270 million	about 0.0025 percent, or 1 in 40,000
Average loss per successful transfer, both chains	$83.8 million divided by 6,633	about $12,600
Average loss on Ethereum	$79.3 million divided by 1,738	about $45,600
Average loss on BNB Smart Chain	$4.5 million divided by 4,895	about $920

The pattern is consistent with the paper's finding that attackers prefer wealthier, more active victims. Attempts are nearly free, so a success rate of one in forty thousand can still pay. The size of the average Ethereum loss also explains why the largest single payoff in the study was about $20 million: the attack picks up large transfers because it waits for them.

Frequently Asked Questions

What is an address poisoning scam?

It is a scam in which an attacker sends you a small transaction from an address that resembles one you use, so the lookalike appears in your transaction history. If you later copy it from the history and send funds, the funds go to the attacker. It exploits copying, not any weakness in your keys.

How do scammers make an address look like mine?

They generate many addresses and keep one that begins and ends with the same characters as the real address. Matching the few characters a wallet displays takes seconds on a GPU. Matching all 40 characters is not feasible, which is why checking the full address defeats the attack.

Does address poisoning steal money from my wallet directly?

No. The poison transaction itself takes nothing from your wallet, as Trezor notes. The loss happens when you send funds to the lookalike address yourself, usually after copying it from your history.

How can I tell if an address is poisoned?

Compare every character with the address you got from the recipient or from your own receive screen. Be suspicious of unexpected zero-value, dust or unfamiliar token transfers, and never copy an address from your transaction history. Some wallets, such as Trezor Suite, flag and blur suspicious entries.

Can stolen funds from address poisoning be recovered?

Sometimes a stablecoin issuer can freeze a balance, and the research reports one case of an attacker address being blocked within about an hour. There is no general route to recovery. Report the loss officially and be wary of anyone who offers to recover it for a fee.

Which wallets or chains are affected?

The research measured Ethereum and BNB Smart Chain, and Trezor names EVM chains including Polygon. Any wallet that displays shortened addresses and lets you copy from history is exposed, so the verification routine applies regardless of the wallet. Attackers reused 16,903 lookalike addresses across two chains.

If you have just been targeted, start with the reporting guide before anything else; it lists the agency for each country and what evidence to save first.