Address Poisoning: The Fake Address Trap in Your Transfer History

Address poisoning is not a hack of your wallet. It ‘plants’ a nearly identical fake address in your transfer history and waits for the day you copy an address out of that history and step right into the trap. Its raw material is public on-chain data, its cost is close to zero, and its entire bet rests on one everyday habit: when you copy a recipient address, you glance at the first and last few characters.

What Is Address Poisoning

Address poisoning is a scam in which the scammer sends token transfers to addresses that look similar to addresses you have interacted with in the past, aiming to make you accidentally send tokens to the wrong address in a later transfer. It exploits no software vulnerability — your wallet and your private key remain intact. What gets exploited is your trust in your own transaction record.

The Two Poisoning Techniques

The first is the fake token method. The scammer deploys a fake token contract with the same name as a popular stablecoin (such as USDC or USDT), monitors transfers of the real token, and then uses the fake token to ‘simulate’ a transfer record that appears to come from your address. When you scroll through your wallet history or a block explorer, you may mistake this fake transfer for real history and copy the scammer’s address inside it — and what you send afterwards are real tokens.

The second is the zero-value transfer method, which is stealthier. The scammer does not need to deploy any fake contract; instead, they use the transferFrom function of the real token contract directly to send a zero-value transfer from your address to a lookalike address that in fact belongs to the scammer. The reason it works: transferFrom only checks that the transfer amount does not exceed the approved allowance, and when the amount is 0, the transfer succeeds even if the allowance is also 0 — no approval from you is needed at any point. Because the real token contract is used, this record shows up in your wallet as ‘a transfer of the real token sent from your address,’ making it hard to distinguish from normal records.

Where You Go Wrong

The victim’s path usually looks like this: the scammer first fabricates credible-looking records that resemble your past transactions. One day you need to repeat a transfer (say, depositing to an exchange), and you casually copy the address you used last time from your wallet history or a block explorer. Because the first and last few characters look the same, you copy the scammer’s address. You confirm and send — and the real tokens land in the scammer’s pocket.

Not a single step in this chain looks ‘abnormal’: the history records genuinely exist (they are merely contaminated), the address looks correct (same first and last characters), and the transfer process is completely normal (you sign it yourself). By the time you notice the mistake, the transaction is already on-chain, and on-chain transfers are irreversible.

Why ‘Check the Head and Tail’ Fails

Many people know they should ‘check the head and the tail’ of an address, but scammers can generate vanity addresses whose first 4 and last 4 characters exactly match your usual address. Generating such addresses takes computing power, yet the cost is entirely acceptable to an attacker. This means the habit of checking only the first and last 4 characters is effectively useless against poisoning attacks — Revoke.cash’s dedicated article on address poisoning explicitly recommends checking more characters.

Where It Sits Among Other Scams

Address poisoning differs mechanically from signature phishing: it needs no malicious signature from the victim — the transfer records come from ordinary transfers the victim initiates themselves (per Revoke.cash’s address-poisoning article), which is exactly why it deserves its own article.

How It Relates to ‘Transferring to the Wrong Address’

On-chain, a transfer caused by address poisoning looks exactly like ‘the user transferred to the wrong address by themselves’ — both are valid signatures on valid transactions. The difference is that an ordinary mistake is random (the address came from wherever), while poisoning is a guided mistake (the address came from a source that was contaminated, and it was still used casually). The practical meaning of this distinction: the key to reviewing a wrong-transfer incident is not ‘be more careful next time’ but ‘where the address came from’ — the defense against poisoning is not at the moment of the transfer; it is at the moment you build your address book or offline list.

Hygiene Habits for Your Wallet History

Poisoning attacks the habit of ‘copying from history,’ so hygiene habits should be built around the history itself: regular cleanup — hide spam tokens in your wallet and filter out dust transfers (a UX improvement that shrinks the surface for mistakes); pin down frequently used addresses — store high-frequency recipients (exchanges, your own wallets) in an address book and always select from it; a process for new addresses — for a new recipient address, the first transfer goes through a small test amount plus confirmation from the recipient. The combined effect of these habits: the action of ‘copying from history’ disappears from your workflow — and the attack surface disappears with it.

‘Two-Person Verification’ for Large Transfers

The review process for large transfers can borrow from institutional practice: two-person verification — a second person (a family member or partner) independently checks the address before execution; segment-by-segment checking — split the address into 4 segments and compare segment by segment instead of comparing the whole string at once (when comparing whole strings, the brain ‘auto-completes’ similar ones); time separation — leave a few minutes between copying the address and confirming the send, so the illusion of similarity fades. Individual users can simply do multi-segment checking on their own; families or teams managing large sums should make two-person verification a formal rule.

Common Mistakes

• Treating transaction history as a contact list: this is the only premise on which poisoning works. Get exchange deposit addresses from the exchange’s official website every time, and confirm with the recipient directly when transferring to a friend.
• Checking only the first and last few characters: scammers can generate addresses matching your first and last 4 characters. Check more characters, or use an ENS name instead of a long address.
• Being complacent about zero-value transfers: a zero-value or tiny unknown transfer appearing in your history is not a ‘coincidence’ — it is part of the poisoning itself. No need to panic, but never treat it as an address source.
• Skipping the second confirmation when transferring: before a large transfer, compare the complete address segment by segment against the one obtained from an official channel, or send a small test amount first.

Risk Notice

On-chain transfers are irreversible. This article is not investment advice. Address poisoning is an operational risk of transferring funds and has nothing to do with market movements — no matter what the market does, the discipline of address sourcing cannot be skipped. If you have been hit, export the transaction hashes immediately and report through channels such as FBI IC3; the chance of recovery depends on law enforcement progress. Do not trust any private message claiming someone ‘can help you recover the funds’ (that is usually a second scam).