Address poisoning is a crypto scam in which an attacker plants a tiny, zero-value or fake-token transaction in your history, using an address that looks almost exactly like one you've used before, hoping you'll copy it the next time you pay. The lookalike shares the first and last characters of the real address, so a quick glance doesn't catch it, and anything you send to it goes to the scammer. It works because public blockchains show who you pay, and because most wallets shorten addresses to their first and last characters. The fix is a set of habits: never copy addresses from your history, check every character, and use an address book.

Current as of October 19, 2026.

The Short Answer

How the scam works

  • A scammer watches public transfers, often stablecoin payments
  • They generate an address with the same first and last characters as one you've paid
  • They send a tiny, zero-value or fake-token transfer so the lookalike appears in your history
  • If you copy the wrong address next time, your funds go to them

How common it is

  • Researchers counted about 270 million attempts against about 17 million victims on Ethereum and BNB Smart Chain over roughly two years, with at least $83.8 million lost

How to avoid it

  • Don't copy addresses from your transaction history
  • Check the full address, including the middle characters
  • Save addresses you pay often in an address book
  • On a hardware wallet, check the full address on the screen against a trusted copy

How Address Poisoning Works

Step 1: The scammer watches who you pay

Every transfer on a public blockchain is visible. As MetaMask's help page explains, attackers monitor transfers, often of stablecoins, to pick their targets. Our guide to who can see your crypto wallet explains what that public record shows.

Step 2: They make a lookalike address

Using a vanity address generator, the scammer creates an address that matches the first and last few characters of an address you've paid or been paid by. Wallet addresses are long strings of letters and numbers, so most people check only the ends.

Step 3: They poison your history

The scammer then makes the lookalike show up in your transaction list. The researchers behind the largest study of the scam describe three ways: a tiny payment from the lookalike, a fake token transfer that copies the amount you really sent, or a zero-value transfer. Zero-value transfers are allowed because the ERC-20 token standard, which most tokens on Ethereum follow, says: "Transfers of 0 values MUST be treated as normal transfers and fire the Transfer event." Many token contracts let anyone move zero tokens on another address's behalf, so the entry can look like a payment you sent to the lookalike yourself. Safe{Wallet}'s help centre shows how these entries are made to mimic a real transaction.

Step 4: You copy the wrong address

Next time you pay that contact, you copy the address from your recent transactions and pick the lookalike by mistake. Blockchain payments can't be reversed, so the funds are almost always lost. Unlike scams that steal your recovery phrase, MetaMask notes, this one depends on you being in a hurry.

Graphic titled How an address poisoning scam works, in four steps: you make a payment that is public, a lookalike address is made with the same first and last characters, your history is poisoned by a tiny, zero-value or fake-token transfer, and you copy the wrong one so funds go to the scammer. A stats strip shows about 270 million attack attempts, about 17 million targeted victims and at least 83.8 million dollars lost in 6,633 incidents on Ethereum and BNB Smart Chain from July 2022 to June 2024. Banner: never copy from history, use an address book, and check every character against a trusted copy, including on a hardware wallet screen

How Common Is Address Poisoning?

Very. In a study presented at USENIX Security 2025, researchers from Carnegie Mellon University and an independent co-author analysed two years of Ethereum and BNB Smart Chain data, from July 2022 to June 2024. According to Carnegie Mellon's CyLab, they identified about 270 million attack attempts targeting 17 million victims. The paper found that 6,633 incidents caused at least $83.8 million in losses, which the authors say makes address poisoning one of the largest crypto phishing schemes seen so far.

Most attempts fail. Etherscan wrote in March 2026 that researchers found a single attempt has a success rate of about 0.01% on Ethereum, which attackers make up for with volume.

How to Avoid Address Poisoning

  • Don't copy addresses from your transaction history. Trezor's support page puts it simply: "avoid copying addresses from transaction history, whether it be from your Trezor Suite or a block explorer."
  • Check every character. Ledger Academy's guide and MetaMask both say to check the full address, not just the first and last characters.
  • Use an address book. MetaMask suggests adding addresses you use often to your contacts, and Etherscan recommends private name tags, ENS names and wallet address books. Check an address before you save it, because a lookalike saved from your history stays poisoned.
  • Check the device screen against a trusted copy. A hardware wallet shows whatever address you pasted, so a lookalike looks the same on the device as on your computer. Compare the full address on the screen with one you know is right, such as the copy in your address book or the one your contact sent you directly.
  • Consider a small test payment for large transfers. Trezor suggests it, at the cost of a second network fee. It only helps if the address you're testing is the right one, so check it first, and send the main payment to that same trusted address rather than one copied from the test in your history.
  • Ignore unexpected tiny, zero-value or unfamiliar token transfers. They don't affect your wallet or keys, according to Etherscan, but they're a sign someone may be targeting you.

What Wallets and Explorers Do About It

Several tools say they flag or hide likely poisoning attempts, according to their own help pages (checked October 19, 2026):

  • MetaMask says it shows a warning when a destination closely resembles an address you've used before.
  • Trezor Suite says it blurs suspicious incoming token transfers in your history and marks them as unverified.
  • Ledger says its Ledger Live app hides zero-value token transfers by default, in a guide last updated August 29, 2025.
  • Safe{Wallet} says it flags imitation transactions and warns you if you try to copy a flagged address.
  • Etherscan says it hides zero-value transfers by default and labels known spoofing addresses.

These features help, but none of them replaces checking the address yourself.

Where Privacy Fits

Address poisoning works because transaction histories are public, so scammers can see who you pay and when, and because shortened addresses are easy to mistake. Privacy tools that hide amounts, such as confidential tokens, keep sender and receiver addresses visible, so they don't stop this scam on their own. The habits above are what protect you, whatever wallet or network you use. Our guide to spending crypto privately covers what else your payments reveal.

Frequently Asked Questions

Can someone steal my crypto by sending me a zero-value transaction?

No. Receiving a tiny or zero-value transfer doesn't give anyone access to your wallet or keys, according to Etherscan. The risk comes later, if you copy the lookalike address and send funds to it. Etherscan advises caution with addresses involved in these transfers, so don't try to swap or sell unfamiliar tokens that arrive this way.

Can I get my crypto back if I sent it to a poisoned address?

Usually not. Blockchain transactions can't be reversed, and the funds go to an address the scammer controls. Report it to your wallet provider and local authorities, and be wary of anyone offering to recover funds for a fee.

Should I hide address poisoning transactions in my wallet?

If your wallet offers to hide or flag them, that reduces the chance of copying one by mistake. It doesn't remove them from the blockchain, so keep checking addresses before you pay.

Where to Go From Here

Address poisoning is easy to beat once you stop copying from your history and start checking every character. To follow how COTI is building privacy into everyday payments, see COTI's roadmap.

Details checked October 19, 2026. Wallet features and research figures can change. Nothing here is financial or legal advice. MetaMask, Trezor, Ledger, Safe{Wallet} and Etherscan are mentioned for reference only and aren't affiliated with COTI. COTI will never ask for your seed phrase or private key, and only COTI's official channels (coti.io, docs.coti.io, COTI's Medium blog and its official X and Telegram) carry announcements.

Sources