How to avoid address poisoning

What it is

Address poisoning targets people who copy wallet addresses from their transaction history. A scammer creates an address that shares the first and last characters of one you use, then gets it to appear in your history.

The scammer doesn’t need your private key or seed phrase. The attack only works if you pick the wrong address and approve the transfer yourself.

How it works

1. The scammer watches public transactions and picks an address you use often.
2. They generate a lookalike address.
3. They send a tiny or zero-value transfer, or a fake token, so the lookalike shows up in your history.
4. Later, you copy the lookalike by mistake and send your funds to it.

How to protect yourself

• Save addresses you use often in your wallet’s address book, after checking them against a trusted source.
• Never copy an address from your transaction history.
• Check the full address on your screen, not just the first and last characters. On a hardware wallet, check it on the device.
• For a large transfer, consider sending a small amount first, confirm it arrived, and then check the full address again.

A hardware wallet protects your keys, but it can’t tell you that you picked the wrong address. You still have to check it.

If you already sent funds

Blockchain transfers generally can’t be reversed. Record the transaction hash, tell the service you used, and report it to the authorities in your country.

Never enter your seed phrase on a website to check or recover funds. Treat anyone who offers to recover your funds for a fee as a likely second scam.