Address Poisoning: What It Is and How to Avoid It

Address poisoning is a scam that does not need your keys, your seed phrase or a malicious website. It only needs you to copy the wrong address from your own transaction history. This page explains how it works, how to spot it and how to avoid it.

How it works

The attacker watches the chain for wallets that send money to a certain address.
They create a look-alike address that starts and ends with the same few characters as the real one you use. Generating one is cheap.
They put it in your history. They send you a tiny or even zero-value transfer from the look-alike address, or a fake token transfer that appears to come from it. Now the look-alike sits in your recent transactions next to the real one.
You copy the wrong one. Next time you pay, you open your history, copy the address that "looks right" (same first and last characters) and send the money to the attacker.

Nothing was hacked. The blockchain did what you told it to do, and a transfer cannot be reversed.

Why it works

Most wallets and explorers shorten addresses to the first and last few characters. A look-alike matches exactly those characters, so at a glance it is the same address. Copying from history feels safe because you have paid that address before.

Which chains are affected

Any chain where a stranger can send you a transfer: Ethereum and the other EVM chains (see what an EVM address is), Tron and others. Single incidents with losses of tens of millions of dollars have been reported.

How to spot it

A transfer you did not expect, often a tiny amount or a token with a strange name, from an address that starts and ends like one you use.
Two similar addresses in your history, one you really paid and one that only ever sent to you.
A counterparty you never sent to. If an address has only ever sent you something and you have never sent anything back, do not treat it as a trusted address.

How to avoid it

Never copy an address from your history or a recent-transactions list. Take it from the source: the person, the invoice, your saved address book.
Compare the whole string, not the first and last characters. Check the middle too.
Use an address book in your wallet for addresses you pay often, and add them once, verified.
Send a small test amount first for large payments, and check on an explorer that it arrived at the right place.
Ignore and do not interact with unexpected tokens and transfers. See fake airdrops and spam NFTs.
On a hardware wallet, read the full address on the device screen before you confirm.

Look at an address before you pay it

Paste the receiving address into an explorer or an investigation tool and look at its history: how old it is, who it deals with, whether it only ever received small transfers. See Best blockchain explorers compared and How to track a crypto wallet for free.

Hopchain does not detect address poisoning automatically. What it can show you is an address's counterparties as a list and a graph. A look-alike usually appears as a counterparty with tiny incoming transfers and no history of you sending anything to it, which is a reason to stop and check. A clean result never proves an address is safe: How to check if a crypto address is a scam.

What to do if you already sent money

Transactions cannot be reversed. Nobody can pull the funds back.
If the address belongs to an exchange, contact that exchange immediately with the transaction hash. See How to check a TXID.
Do not trust "recovery" services that contact you. They are a second scam.
Report it to the police and to scam-reporting services, and keep the transaction hash and addresses.

This is general information, not financial or security advice.

Frequently asked questions

What is address poisoning?
A scam in which an attacker sends you a transfer from an address that looks like one you use, so that you later copy the look-alike from your history and send money to it.

Is address poisoning a hack?
No. Your wallet and keys are not touched. You send the money yourself, to the wrong address.

Can I get the money back?
Almost never. Blockchain transfers cannot be reversed. If the funds went to an exchange deposit address, contact the exchange at once.

Why do the first and last characters matter?
Wallets and explorers usually show only those, so a look-alike that matches them looks identical at a glance.

Does a zero-value transfer cost the attacker anything?
Only the network fee. That is why attackers send many of them.

Does Hopchain stop address poisoning?
No. It shows who an address has dealt with, which can help you notice a suspicious address, but it does not detect poisoning by itself.

Keep reading

Curious what a wallet has been doing? Check any address on Hopchain. It's free and needs no signup.

Address poisoning: what it is and how to avoid it