Myntkaup logo
IS
EN
Login

Address poisoning

In IcelandicEitrun veskisfangs

A scam where a lookalike of an address you use is planted in your transaction history, in the hope that you copy it and send crypto to the scammer.

Address poisoning is a scam aimed at people who copy wallet addressesWallet addressA string of letters and numbers you give out to receive crypto, much like a bank account number. from their transaction history. The name refers to the scammer "poisoning" your history with a fake address that looks like one you have used before. If you copy it instead of the real one, the crypto goes straight to the scammer, and the TransactionTransactionA record of crypto moving from one wallet address to another, signed with the sender's private key and stored permanently on the blockchain. can't be reversed.

How does it work?

  1. The scammer watches public transactions on the BlockchainBlockchainA public ledger where transactions are grouped into blocks, each linked to the one before, so past records can't be altered without it showing. and sees that you regularly send to a particular address, for example your account at a crypto exchange.
  2. They create an address that starts and ends with the same characters. Most wallets only show the first and last few characters, so the fake looks identical at a glance.
  3. They send you a tiny amount, or worthless tokens, from the fake address. Now it shows up in your transaction history.
  4. The next time you send, you copy the address from your history and pick the fake one by mistake.

The attacks are automated and cheap, so they happen on a huge scale. A study presented at the USENIX Security conference in 2025 counted about 270 million such attempts on Ethereum and BNB Smart Chain over two years. Losses came to at least 83.8 million US dollars. In May 2024 one user sent 1,155 WBTC, worth about 68 million dollars, to a fake address. The scammer later returned most of it, but that is rare.

How do you protect yourself?

  • Never copy an address from your transaction history. Get it directly from the recipient, or from a saved list you have checked.
  • Compare the whole address, not just the first and last characters.
  • Send a test transaction with a small amount when a lot is at stake, and have the recipient confirm it arrived.
  • Ignore unexpected tiny payments and unfamiliar tokens in your wallet. Don't try to sell them or interact with them in any other way.

Address poisoning doesn't break your wallet's security. The scammer never gets your private keyPrivate keyA secret number that proves you own the crypto in your wallet. Whoever holds the private key controls the crypto.. They are relying only on you being in a hurry and copying the wrong address.

Everything in Myntkaup Learn is written and regularly reviewed by the Myntkaup editorial team. It is for education and is not investment advice. Editorial policy. Updated 2 November 2026.