Address poisoning
A scam that plants a look-alike address in your transaction history, with a transfer of zero, a tiny amount or a fake token, so that the next time you copy an address from there, you copy the attacker's.
Addresses are long strings that are hard to remember, so people copy them, often from their own history of past transfers. Address poisoning turns that habit against them. Right after you send to someone, an attacker generates an address whose first and last characters match theirs, and sends you something from it. Your history now holds an address that looks, at a glance, like one you use, and a transfer of zero can even appear as one you sent.
Researchers at Carnegie Mellon University counted 270 million poisoning attempts on Ethereum and BNB Smart Chain between July 2022 and June 2024, aimed at 17 million targets. About 148 million were transfers of zero, 118 million fake tokens and 4 million tiny amounts. Of all those attempts, 6,633 worked, for losses of at least 83.8 million dollars, and the study counted stablecoins only.
A test transfer doesn’t protect you if you copy the address again afterwards. In December 2025, someone sent a test worth 50 dollars to the address they meant to pay. An attacker’s script immediately produced a look-alike with the same first five and last four characters, and sent small transfers from it to their wallet. The full amount went out 26 minutes after the test: nearly 50 million dollars’ worth of a stablecoin, to the look-alike, most likely copied from their history, according to The Block.
What protects you is never taking an address from your history. Use one you saved in your wallet’s address book after checking it, or get it again from the receiver, and compare the whole address, not just its ends. The guide on sending and receiving digital dollars goes through the checks, and the one on crypto scams through the tricks around them.