)
Operating Web3 wallets has long been considered a barrier to entry for beginners to the blockchain world. Before spot ETFs, these digital wallets were mostly essential to buy and hold crypto, and remain vital to interact with DeFi tools.
Understanding the complexities, many in the industry have prioritised simplifying wallet interfaces. Now, most people can send and receive crypto by copy-and-pasting an address into an app – visually as complex as sending an email, or transferring money via a bank.
However, these advancements, paired with growing adoption, have opened the door to a form of crypto scam known as address poisoning.
Address poisoning
Address poisoning leverages the relative complexity of crypto wallet addresses to trick people into sending money to the wrong account.
Typically, a crypto wallet public key comprises 26 to 63 alphanumeric characters. As this ends up looking like a random assortment of numbers and letters, it’s quite a mouthful – and most don’t have the patience to double-check every single character.
This is what address poisoning scams take advantage of. Scammers create an address that mimics a real, trusted address, but make minor changes in the hope you won’t notice. For example, they might generate a wallet address with the same first and final four numbers/letters as the real address, but alter characters in the middle.
The scammers then send a ‘dust’ amount of cryptocurrency to put the fake address at the top of the target’s recent transactions list. Without proper attention, the victim may unwittingly send crypto to this address, thus losing their funds.
)
Who can be targeted by address poisoning?
Address poisoning attacks typically target those who are active within the DeFi space.
The permissionless nature of the blockchain means transactions – and public addresses – are visible across most networks.
In theory, this means that anybody who has ever sent crypto on a public blockchain is susceptible to address poisoning scams. However, the risk is greater for those who are deeply engaged in DeFi ecosystems. High-frequency traders, for example, often manage funds across multiple wallets. They rely on copying and pasting addresses due to the sheer volume of transactions they execute each day, which could increase the likelihood of sending funds to a poisoned address.
Case study: Address poisoning
There are several ways address poisoning scams can play out, but perhaps the most common example follows:
Sending ETH to a ‘friend’
You send ETH from your wallet to a friend’s address: 0xA1B2...1234
A scammer monitors the blockchain and sees your transaction.
They send a tiny amount of ETH (e.g., 0.000001 ETH) from a malicious address to your wallet, but they craft their sending address to look very similar to your friend’s:
Real friend: 0xA1B2...1234
Scammer: 0xA1B2...12F4
In your wallet’s transaction history, you see something like:
“Received 0.000001 ETH from 0xA1B2...12F4”
At a glance, the address strings appear the same. So later, when you want to send more ETH to your friend, you open your history and pick the ‘recent address’ that looks like your friend’s, without checking carefully.
You paste/use the scam address and send a large amount.
Result: the funds go to the scammer’s address and are likely unrecoverable.
)
This example isn’t just limited to sending crypto to your friends and family – address poisoning can happen when using exchange wallets, DeFi protocols and NFT marketplaces.
How to protect against address poisoning
One of the more effective ways to reduce the risk of address poisoning is to double-check the addresses you’re sending crypto to and from. While this can be a little time-consuming and inconvenient, it is also one of the more reliable ways to reduce the risk.
Other, practical methods include:
If you do lack the time to check a full public address, at least cross-reference more than just the first and last four characters. Break the address up into sections, and compare 3-4 strings of characters to verify the recipient.
Use saved contacts / address books in your wallet instead of copying from transactions.
For large transfers, do a small test transaction first, then confirm receipt before sending the full amount.
Treat unexpected small deposits (especially in obscure tokens) as suspicious, not as a gift.
Did You Know?
In March 2026, a crypto ‘whale’ using the Ton ecosystem fell victim to an address poisoning scam, transacting 126k TON (worth approx. $229k AUD) to someone else’s wallet. In a stunning turn of events, the scammer, in a moment of (relative) benevolence, returned 116k TON, stating in the transfer memo: I’m sorry, but this is far too much. Please take it back — I know it’s a serious amount of money. Peace.
More information
Address poisoning has arisen as an awkward issue within the crypto space. Simplifying the process of sending/receiving digital currencies is a key goal of modern industry players – but mitigating the risk of people exploiting this streamlined approach is of equal importance. Luckily, there are a few potential safeguards you can employ while navigating the engrossing Web3 ecosystem to tackle the dangers of address poisoning.
Educating yourself and those in your community can be a useful preventative measure against scams like address poisoning. Global blockchain analytic firms like Chainalysis work to provide vital data, return stolen funds to victims and collaborate with law enforcement to dismantle the systems used by these bad actors. To learn more, consider some of the additional reading below.
Additional reading: