Address Poisoning: The Copy-Paste Crypto Scam and How to Avoid It

Address poisoning does not hack anything. It relies on one habit almost everyone has: copying a recipient address from your own transaction history instead of from the original source.

How the scam works

1. You send funds to an address you use often, for example your exchange deposit address.
2. The attacker watches the chain, sees the transfer, and generates a vanity address whose first and last few characters match the one you sent to. Producing a match on the visible characters takes ordinary hardware minutes to hours.
3. The attacker then makes your history show that look-alike: a tiny transfer, a zero-value transfer of a token, or a transfer of a counterfeit token with the same name and symbol as a real one.
4. Next time you go to pay that address, you open your history, see an entry that looks right at a glance, and copy the attacker's address instead.

Why zero-value transfers appear

On many ERC-20 tokens, anyone can call transferFrom for an amount of zero, and the token still emits a transfer event naming your address as the sender. Explorers and wallets then show a transaction "from you" that you never signed. Nothing left your wallet, and there is nothing to reverse, but the record is there to copy.

Who gets targeted

Generating look-alike addresses and paying fees for the planted transfers costs money, so attackers concentrate on wallets that move large amounts regularly, often stablecoins. A single mistaken copy can be worth the effort of thousands of failed attempts.

How to protect yourself

• Never copy an address from your transaction history. Copy it from the source: the exchange's deposit page, the recipient's own message, or your wallet's saved address book.
• Use the address book. Save addresses you pay often, with a name, and send only to saved entries.
• Compare the whole address, not the ends. Check a block of characters in the middle as well.
• Send a small test first for any large or first-time transfer, and confirm it arrived.
• Hide or ignore unknown transfers. Many wallets let you hide zero-value and spam token transfers so they never show up as something to copy.

If it already happened

On-chain transfers cannot be reversed. Report the receiving address to the platform you sent from and, if the amount is significant, to the authorities, and keep the transaction hash. If the funds went to an exchange deposit address, that exchange is sometimes able to freeze them. Treat anyone who contacts you offering recovery for a fee with suspicion: recovery offers are a common follow-up scam.

Related: why unknown tokens appear in your wallet and how to check and revoke token approvals.