Address poisoning: the lookalike address scam
The attacker never touches your wallet. They wait for you to copy the wrong address.
Address poisoning is a scam where an attacker creates a wallet address that starts and ends with the same characters as one you've used, then sends a tiny or zero-value transfer from it so it appears in your transaction history. If you later copy the address from your history instead of from a trusted source, your money goes to the attacker. It can't be reversed.
Legitimate support will never ask for your seed phrase (recovery phrase) or private key. Not an exchange, a wallet maker, a lawyer, the police or the FBI. Anyone who asks for it, or asks you to type it into a website, is trying to steal from you.
How it works, step by step
- Watching. Bots scan public blockchains for wallets that move meaningful amounts, especially stablecoins such as USDT and USDC.
- Making a twin. For an address you send to often, the attacker generates a "vanity" address whose first and last few characters match. Wallets and explorers often shorten addresses to something like
0x7a3f…9c21, which is exactly the part that matches. - Poisoning your history. The twin sends you a tiny amount, a fake token with a familiar name, or a zero-value transfer. Some token contracts even let a stranger create a zero-value entry that looks as if you sent to the twin.
- The copy. Next time, you open your recent activity, copy the address that looks right, and send.
- The getaway. Within minutes the funds are swapped into something that can't be frozen and moved through mixers.
Real examples
- May 3, 2024: one holder sent about $68 million in wrapped bitcoin (WBTC) to a poisoned address. Unusually, after public on-chain negotiation, the attacker returned nearly all of it within about a week. That almost never happens.
- December 20, 2025: a trader withdrew about $50 million in USDT from Binance. They did the sensible thing and sent a 50 USDT test first, but the attacker saw the test and poisoned their history with a twin matching the first five and last four characters. About 26 minutes later the trader copied the twin from their history and sent 49,999,950 USDT. Within 30 minutes it had been swapped to DAI (which, unlike USDT, its issuer can't freeze), then to about 16,690 ETH, and moved into Tornado Cash. The victim offered a $1 million bounty for its return.
The second case shows why a test transaction alone isn't enough: it confirms the address you tested, not the one you paste next.
Warning signs
- Incoming transfers of 0 or a few cents from addresses you don't know, right after you made a payment.
- Tokens you never bought, often named like a stablecoin, appearing in your history.
- Two entries in your history whose shortened addresses look identical.
- Your explorer marking a transfer as "spam" or hiding zero-value transfers.
How to avoid it
- Never copy an address from your transaction history. Copy it from the source: the receiving exchange's deposit page, your own address book, or the person you're paying, confirmed by another channel.
- Use an address book or a withdrawal allowlist. Most exchanges let you save approved withdrawal addresses and lock withdrawals to that list.
- Check the middle too. Compare the full address, or at least the first, middle and last groups of characters. On a hardware wallet, check it on the device's screen.
- After a test, copy fresh again from the trusted source for the main payment.
- Follow the before-you-send checklist for every large transfer.
If it happened to you
- Tell the stablecoin issuer quickly. Issuers such as Tether (USDT) and Circle (USDC) can freeze tokens at a specific address, usually when law enforcement asks. This only works before the attacker swaps them, which is often within minutes, so report to the FBI and your exchange at once.
- Write everything down before anything gets deleted: wallet addresses, transaction IDs (hashes), website addresses, usernames, phone numbers, screenshots of chats, dates and amounts.
- Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Reports are free. If funds land at a regulated exchange, law enforcement can sometimes freeze them, and speed matters. A local police report gives you a reference number for your bank or insurer.
- Contact the exchange you sent from, and the receiving exchange if the blockchain shows one, through its official website or app (never a number or link from a search ad or a stranger). Ask them to flag the addresses and the transactions.
- Expect a second scam. Victims are targeted again by fake "recovery" firms, fake lawyers and fake FBI agents. Real law enforcement never charges a fee. Read crypto recovery scams.
Need the steps in order? Use the emergency checklist for a compromised wallet or account.
Frequently asked questions
Can address poisoning steal from my wallet directly?
No. It can't move anything by itself. It only works if you send funds to the lookalike address.
Is it safe to interact with the tiny transfers I received?
Don't. Ignore them, don't send them back, and don't visit any website named in a token you didn't buy.
Does a test transaction protect me?
Only for the address you tested. Copy the address again from a trusted source for the real payment, and compare the whole thing.
Can I get the money back?
Rarely. Report it immediately; stablecoins can sometimes be frozen before they're swapped, but most poisoning losses are permanent.
Where to next
Sources
- Crypto trader loses $50 million in address poisoning attack (The Block, December 2025)
- $68 million stolen in dust attack returned to victim (Unchained, May 2024)
- Ethereum security and scam prevention (ethereum.org)
- FBI Internet Crime Complaint Center (report a crime)
Written for beginners and checked against the sources listed. Last reviewed November 5, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.