Short answer: address poisoning is a scam in which an attacker sends you a tiny or zero-value transaction from an address that looks almost identical to one you use. They are betting that next time you will copy the destination from your transaction history and paste theirs by mistake. The defence is simple: never copy addresses from your history, and verify every character on your device.

How the attack works

  1. The attacker watches the blockchain for wallets that move significant amounts.
  2. They generate a “vanity” address whose first and last characters match an address you regularly send to.
  3. They send a dust or zero-value transfer so that the lookalike appears in your transaction history.
  4. Later you open your history, copy what looks like the usual address, and send your funds to the attacker.

No password is stolen and no device is hacked: the victim signs a perfectly valid transaction. That is why it works against careful people too.

A real case: 1,155 WBTC in one transaction

In early May 2024, the security firm Cyvers flagged a trader who lost 1,155 wrapped bitcoin (WBTC), worth about $68 million at the time, in a single address-poisoning transfer. According to Cointelegraph’s reporting, a fake transaction had made the attacker’s address look like the victim’s own. In an unusual twist, the attacker returned nearly all of the funds a few days later after negotiations. Most victims are not that lucky.

How to protect yourself

  • Never copy a destination from your transaction history or from a block explorer list.
  • Use a verified address book: save each recipient once, after confirming the full address through a separate channel.
  • Check the whole address on your hardware wallet’s screen, not just the beginning and the end.
  • Send a small test transaction before large transfers, and have the recipient confirm it arrived.
  • Ignore unexpected zero-value or dust transfers. Do not interact with them.

Frequently asked questions

Can someone poison my address without my keys?

Yes. Anyone can send a transaction to any public address, so attackers can make lookalike addresses appear in your history without touching your wallet. The danger only starts if you copy one of them.

I received a zero-value transfer from an unknown address. What should I do?

Nothing. Do not interact with it, and never copy that address. Some wallets let you hide such transactions.

Does address poisoning affect Bitcoin?

It is most common on account-based networks such as Ethereum and other EVM chains, where token transfers make it cheap to fill your history. The defence is the same everywhere: verified address books and full checks on your device.

Sources

Educational content, not financial advice. Some links on this site are affiliate links: see our disclosure.