Address Poisoning

Address Poisoning

Address poisoning is an attack where a scammer sends a tiny, often zero-value, transaction from a wallet address deliberately crafted to closely resemble one the victim has legitimately transacted with before, hoping the victim later copies the wrong address from their own transaction history.

What it means

The attack exploits a common shortcut: many users copy a recipient address from a past transaction in their wallet's history rather than re-typing or re-verifying it in full. Because most wallet interfaces truncate addresses to show only the first and last several characters, a poisoned address that matches those visible characters can look identical at a glance while differing entirely in the middle.

Detecting poisoning requires recognizing the pattern itself — a zero-value or dust transaction from an address with a suspiciously similar prefix and suffix to one already in the victim's history — rather than evaluating the poisoning transaction alone, which by design looks harmless and carries no value at risk.

Real-world example

A victim who previously sent 10,000 USDT to a legitimate exchange address later copied what looked like the same address from their history and sent 100,000 USDT to it, only for it to be a poisoned look-alike planted by an attacker weeks earlier — an incident pattern that has cost victims tens of millions of dollars industry-wide.

Related terms

• Dusting Attack
• Phishing Address
• Scam Address

In FreezeRadar

FreezeRadar's pattern catalog flags address-poisoning attempts in a wallet's incoming transaction history, so you can spot a look-alike dust transaction before it leads to a mistaken transfer.

Check a wallet now