What Is Address Poisoning and How Do You Avoid It?

Address poisoning is a scam that does not hack your wallet or steal your private keys. Instead, it relies on a simple human habit: copying an address from a place that looks familiar. The attacker's goal is to get you to send your own funds to the wrong address, voluntarily and by mistake.

To understand why it works, it helps to know a few facts about how blockchains handle addresses. A wallet address is a long string of letters and numbers that is almost impossible for a person to read or memorize in full. Because of that, people tend to recognize addresses by their first few and last few characters. Many wallets and block explorers also display shortened versions, showing only the beginning and end with dots in the middle. On top of that, blockchains are open networks. Anyone can send a transaction to any address without asking permission, and all transactions are publicly visible.

Here is how the scam typically unfolds. The attacker watches the public blockchain and notices that you recently sent funds to a particular address. They then generate a new address that starts and ends with the same characters as the one you used. This is done by repeatedly creating new addresses by computer until one happens to match the pattern. Matching a handful of characters at each end takes far less effort than matching the whole address, so this is practical for a determined attacker.

Next, the attacker sends you a transaction from that lookalike address. It might be a very tiny amount, a transfer of zero value, or a worthless token made to look like a normal one. The amount does not matter. What matters is that the transaction now appears in your wallet's history, sitting right next to your real, legitimate transactions. In some versions, the attacker also sends a small transfer from the lookalike address to the address you actually paid, or makes the entry appear as though it came from you, so that the fake looks even more natural.

The trap springs later. When you need to pay the same person or service again, you might open your transaction history, find a recent entry that appears to match, and copy the address from it. If you copied the lookalike, you paste it, glance at the first and last few characters, see what you expect, and confirm. The funds go to the attacker. Blockchain transactions are generally irreversible, so there is usually no way to pull them back.

This scam is effective because it uses ordinary convenience against you. Copying from history feels safer than typing, since it seems like an address you have already verified. Shortened displays hide exactly the part of the address where the difference lives. And because no malware or password theft is involved, there is no alarm or warning sign. Everything you did looked normal.

The good news is that avoiding address poisoning mostly comes down to a few consistent habits. The most important one is to never copy a recipient address from your transaction history. History is a record of what happened, and anyone can add entries to it. Instead, get the address directly from the source, such as the recipient or the official page of the service you are paying, or from an address you saved after verifying it carefully.

When you do check an address, compare more than the beginning and end. Look at the middle characters too, or better yet compare the entire string piece by piece. If you use a hardware wallet with its own screen, check the full address shown there, since that display is separate from your computer or phone.

Saving trusted addresses in an address book, or using a whitelist feature if your wallet or exchange offers one, can also help. The key is to add an address only after you have verified it through a reliable channel. From then on, choose it from the saved list instead of copying and pasting from elsewhere.

For larger transfers, many people send a small test transaction first, wait for it to arrive, confirm with the recipient, and then send the rest. This costs an extra network fee, but it gives you a chance to catch a mistake while it is still cheap.

It is also wise to treat unexpected incoming transactions with suspicion. If a tiny deposit or an unfamiliar token shows up that you did not ask for, do not interact with it, and do not use it as a source for any address. Some wallets let you hide or flag suspicious transactions, which can reduce the chance of confusion later.

If you realize you have sent funds to a poisoned address, act quickly but realistically. Because transactions are final, recovery is rarely possible. If the destination was an exchange deposit address, contacting that exchange's support may be worth trying, though there is no guarantee. Be wary of anyone who contacts you offering to recover the funds for a fee, as that is often a second scam.

In short, address poisoning succeeds by making a fake address look familiar. Slow down, verify the full address from a trusted source, and never treat your own history as proof that an address is correct.

This article is for general education only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Cryptocurrency carries real risk of loss; always do your own research before making a financial decision.