What is address poisoning in crypto?

Address poisoning is a crypto scam in which a criminal plants a look-alike address in your transaction history, hoping you will copy it later and send funds there. It does not hack your wallet. It exploits the habit of copying an address from past transactions and checking only its first and last few characters. Our guide to what a wallet address is gives a short overview; this one goes deeper.

How does an address poisoning attack work?

The scammer watches public blockchain data for wallets that send regularly to the same address, such as an exchange deposit address. Trezor explains that the scammer then generates a "vanity" address whose opening and closing characters match that destination. Next, the scammer sends a transfer from the look-alike to the victim. Chainalysis reports that toolkits for generating these addresses and seeding them are sold on darknet markets.

Trezor says the attack mostly targets Ethereum and other EVM-compatible chains such as BNB Smart Chain and Polygon, where low fees make sending thousands of bait transactions cheap.

What is a zero value transfer scam?

The bait transfer often carries no real value. It may be a transfer of zero tokens, a tiny amount of a real coin, or a fake token named to look like USDT or USDC. Some copy the amount of a real recent transaction to look familiar. All of these exist only to get the look-alike address into your history. A related tactic, sending tiny amounts to trace wallet owners, is explained in what is a dusting attack.

Explorers have responded. Etherscan began hiding zero-value token transfers by default in April 2023, and as of March 2026 it also labels known poisoning addresses, tags spoofed tokens, highlights similar-looking addresses and shows a warning when you copy a suspicious one.

How big is the address poisoning scam?

Chainalysis studied one campaign that ran on Ethereum from February to May 2024. It identified more than 82,000 seeded addresses, likely an undercount, and found that 2,774 victims sent about $69.7 million to them. Most seeded addresses received nothing. The largest single loss was about $68 million in wrapped bitcoin, sent on May 3, 2024, after the victim had made a small test payment. The scammer returned the original amount days later following negotiations, an unusual outcome.

What does the Trezor address poisoning alert do?

Trezor Suite filters incoming token transfers for traits common in poisoning attempts. Flagged entries are blurred in the transaction history, marked as unverified, and come with a notification. Other wallets and explorers have added similar warnings.

Practical habits that sources recommend:

• Never copy a destination from transaction history, including your own past withdrawals.
• Compare every character on your hardware wallet screen before confirming.
• Save trusted addresses in an address book or use address whitelisting on exchanges.
• Send a small test amount first, then confirm the full address again for the main transfer. The $68 million loss came after a test payment.

Mistaken transfers are usually permanent. If it happens, see what to do if you are scammed.