What is Address Poisoning?
Address poisoning is a sophisticated crypto scam that targets one of the most common user behaviors: copying and pasting wallet addresses from transaction history. In this attack, scammers create “vanity” addresses that look incredibly similar to yours or addresses you interact with frequently—often matching the first and last few characters.
They then send a transaction of 0 value (or a tiny amount of tokens) to your wallet from this lookalike address. The goal is simple: to “poison” your transaction history so that next time you need to send funds, you’ll copy their address instead of the legitimate one.
How the Scam Works
- Monitoring: Scammers watch the blockchain for high-value transfers.
- Generation: Using tools like Profanity, they generate an address that matches the start and end of your intended recipient’s address.
- Poisoning: They send a $0 transaction (or a fake token) to your wallet.
- The Trap: Later, when you go to your wallet history to copy the address for a new transaction, you accidentally select the scammer’s address because it looks familiar.
Why It’s Dangerous: The “First & Last” Blindspot
Most crypto users only verify the first 4-6 characters and the last 4-6 characters of an address. Scammers know this. A poisoned address might look like this:
- Legitimate Address:
0x123...abc - Poisoned Address:
0x123...abc(but the middle characters are completely different)
Because the transaction appears in your history, your brain assumes it’s a past valid interaction.
How to Protect Yourself
1. Don’t Rely on History
Never copy addresses blindly from your transaction history. Always verify the address from the original source (e.g., the recipient’s request, a saved contact, or an official deposit page).
2. Check Every Character (or use a Checker)
While checking specifically the middle characters is tedious, you should verify more than just the tips. Better yet, check a random sequence in the middle.
3. Use ENS or Address Books
Use Ethereum Name Service (ENS) domains (like yourname.eth) or the “Address Book” feature in wallets like MetaMask or Rabbit. Whitelisting addresses prevents you from pasting a random one.
4. Test Small First
If sending a significant amount, always send a small test transaction first. Once confirmed, send the rest.
Conclusion
Address poisoning relies entirely on user error. The blockchain itself isn’t hacked; your attention is. By slowing down and verifying addresses properly, you can render this attack completely useless. Stay vigilant and keep your assets safe.
