Every Other Defence You Have Is Useless Against This
Hardware wallet? Doesn’t help. Transaction simulation? Won’t flag it. Approval audits, revoke.cash, Permit2 hygiene, phishing detection, a dedicated browser profile? None of them touch it.
Address poisoning defeats every technical control in your stack because nothing about the transaction is malicious. You authorise it. You sign it on your hardware wallet. The simulation shows exactly what will happen, because exactly what you asked for is what happens.
The only thing wrong is the destination, and you put it there.
A single documented address-poisoning incident cost one victim $50 million. It belongs in a different mental category from drainers, and it needs a completely different defence.
How It Works
Step 1: The attacker watches your wallet
Blockchain activity is public. Anyone can monitor an address and see every transaction it makes — including who you send funds to, how often, and in what amounts.
An attacker running this at scale monitors thousands of wallets simultaneously, looking for repeated transfers to the same destinations. Those patterns are the target: an address you send to regularly is an address you’ll send to again.
Step 2: The attacker generates a lookalike
Here is the mechanical core of the attack.
Crypto addresses are long and effectively unreadable. An Ethereum address is 42 characters of hexadecimal. Nobody reads them in full. Virtually every wallet interface, block explorer and app displays them truncated — the first six characters, an ellipsis, the last four.
So an attacker generates an address matching your real destination’s first and last characters, and leaves the middle entirely different. This is computationally cheap. Matching a handful of characters at each end takes ordinary hardware minutes.
Displayed truncated, the fake and the real are visually identical. Not similar. Identical, in every interface that truncates.
Step 3: The attacker plants it in your history
The attacker sends you something from the lookalike address — typically a zero-value transfer, a tiny amount of dust, or a worthless token. The amount doesn’t matter; the point is to create a transaction record.
Your wallet now shows an entry from an address that looks exactly like the one you send to regularly.
Step 4: You poison yourself
The next time you make that routine transfer, you do what almost everyone does: open your transaction history, find the recent entry for that recipient, copy the address, and paste it.
You copy the attacker’s.
You check it — glancing at the first four and last four characters, which match perfectly. You confirm on your hardware wallet, where the same truncation often appears. You send.
The funds are gone, irreversibly, to an address you selected yourself.
Why It Keeps Working on Careful People
Three reasons, and none of them are carelessness.
Truncation is universal. Wallets, explorers, exchanges and apps all abbreviate addresses, because showing 42 characters in a list is unusable. The attack exploits a design convention that exists everywhere for good reasons.
Transaction history feels authoritative. It’s your own record of your own activity. People treat “copy from history” as safer than retyping, and in every other respect it is — which is exactly why the attacker puts something there.
The verification habit is wrong. Almost everyone checks the first and last few characters. That habit was reasonable when the risk was a typo or a corrupted paste. Against an attacker who deliberately matches those exact characters, it is worse than no check at all, because it produces false confidence.
Variants Worth Knowing
Zero-value transfers. A transaction moving nothing, purely to appear in your history. Some wallets filter these; many don’t.
Dust and spam tokens. A tiny amount of a real asset, or a worthless token sent to your address, achieving the same presence in your history. Spam NFTs serve the same function on networks that support them — which is why wallets like Phantom let you report, hide, or burn them.
Clipboard hijacking is a different attack with the same outcome. Malware on your device swaps the address between copy and paste. The 2026 Torg Grabber campaign did exactly this, affecting hundreds of wallets. The defences overlap substantially, but the cause and remediation differ: clipboard hijacking means your device is compromised, which is a much larger problem. Related: The Extension You’ve Trusted for Years Can Be Sold to a Thief
ENS and domain lookalikes. Where human-readable names are used, the same logic applies with visually confusable characters.
The Defences That Actually Work
Behavioural, not technical. There is no tool that fixes this.
1. Verify the entire address, or verify nothing
The single most important change.
Check the whole address, or at minimum a block from the middle as well as both ends. The attacker controls the first and last characters by construction; they do not control the middle, because matching the full string is computationally infeasible.
If checking 42 characters feels excessive, check the ends and a 6-character run from the centre. That defeats the attack at a fraction of the effort.
Read it on your hardware wallet’s screen. This is the surface no software-level attacker can forge — but only if you actually read it rather than confirming reflexively, and only if your device shows enough of it. Where a device truncates, scroll.
2. Use an address book, not your history
Every major wallet supports saved addresses. Add each recipient once, verified fully at the time you add it, then always send from the saved entry.
Then stop copying from transaction history entirely. That one habit change removes the attack surface completely, because the attacker’s planted entry never enters your workflow.
This is the highest-leverage item in this article. Most wallets call it an address book, contacts, or saved recipients.
3. Test with a small amount
For any significant transfer, especially a first-time one, send a trivial amount first. Confirm receipt with the recipient through a separate channel. Then send the rest.
The cost is one extra network fee. The alternative cost has reached $50 million.
4. Hide spam and dust
Filter zero-value transactions where your wallet supports it. Hide or burn spam tokens and NFTs. A clean transaction history makes a planted entry conspicuous rather than camouflaged.
5. Confirm destinations out of band for large transfers
For anything substantial, verify the address with the recipient via a channel that isn’t the one it arrived on — a phone call, in person, a different messaging platform. This defends against address poisoning and against the broader class of business-email-compromise attacks that swap payment details mid-conversation.
If It Already Happened
Be direct about this: there is no technical remediation. You authorised a valid transfer to an address you selected. No signature to revoke, no approval to withdraw, no contract to blacklist. The transaction is final.
What you can still do:
- Document it. Transaction hash, the attacker’s address, the legitimate address, timestamps.
- Report the address to Chainabuse and relevant blockchain abuse databases. Address poisoning is run industrially; your report contributes to clustering.
- File a police report, particularly for significant amounts, and with your national regulator if a platform was involved.
- Check whether funds moved to an exchange. If the attacker’s address deposits to a centralised exchange, that exchange can potentially freeze it with a law enforcement reference. This is rare but it is the one realistic recovery path.
- Record the loss for tax purposes. Related: Your Crypto Was Just Stolen: What to Do in the First 24 Hours
- Change the behaviour. Set up an address book today. Audit every saved address you already have.
And: nobody who contacts you offering to recover it can do so. Address poisoning victims are heavily targeted by recovery fraud, for the obvious reason that the loss is public on-chain and the victim is identifiable.
Frequently Asked Questions
Can a hardware wallet prevent address poisoning?
Only if you read the full address on the device screen and catch the mismatch. The device displays the truth; it cannot make you read it.
Will transaction simulation catch it?
No. The transaction is exactly what you constructed. Simulation reports it accurately.
Why does my wallet show transactions from addresses I don’t recognise?
Anyone can send to your address without permission. Most are spam or poisoning attempts. Receiving them is harmless; copying from them is not.
Is this the same as clipboard hijacking?
No. Address poisoning plants a bad address in your history; clipboard hijacking is malware swapping your clipboard. Similar outcome, different cause, and the second means your device is compromised.
Does this affect Bitcoin too?
Yes. Any blockchain with long addresses and truncated display is vulnerable, including Bitcoin and Solana.
The Bottom Line
Address poisoning is the most preventable major attack in crypto and one of the most expensive, because the defence is a habit rather than a product and habits are harder to install than software.
Three things:
- Use an address book. Never copy from transaction history.
- Verify the middle of the address, not just the ends.
- Send a test amount for anything significant.
Every security tool you own protects you from someone else doing something to your wallet. This is the attack where you do it yourself, and the only countermeasure is changing what you do.
Transparency: TrueToCrypto may earn affiliate commissions from links in articles. Recommendations are based on security merit, not commission rates. This article is educational and is not financial or security consulting advice.
Contact: info@truetocrypto.com
