Address poisoning: how it works and how to avoid it
Attackers plant look-alike addresses in your transaction history and wait for you to copy the wrong one. Here is how to spot it and how to make it impossible.
Updated 14 Sept 2026 · Beginner · 2 min read
In short
- Address poisoning plants an address that looks like one you use (same first and last characters) in your transaction history.
- It only works if you copy an address from your history and check just its ends.
- Take addresses from a trusted source, check every character (or use an address book), and send a test amount for large payments.
How the attack works
Most people check an address by glancing at its first and last few characters. Attackers exploit that. They watch the chain for payments between you and someone you pay regularly, then generate a vanity address whose beginning and end match the real one, a matter of seconds to hours of computing, depending on how many characters they match.
Next they make that address appear in your history: a tiny payment, a zero-value token transfer, or a transfer of a fake token that imitates a real one. The next time you open your wallet’s history to copy “the usual” address, the look-alike is right there near the top.
Where it shows up
- EVM chains (Ethereum, Base, Arbitrum and others) are the main target. Many token contracts allow a transfer of zero tokens “from” any address, and fake token contracts can emit transfer events naming any address, so an attacker can put entries in your history without you doing anything.
- Bitcoin is less exposed because it has no token events, but small payments from look-alike addresses have been used the same way.
- Stablecoin transfers are a favourite target, because they are frequent, large and repetitive.
How to spot it
- Zero-value transfers, or transfers of a token you have never held, appearing in your history.
- An address in your history that matches a familiar one at both ends but differs in the middle.
- A token with a familiar name and symbol but a different contract address.
Our address poisoning checker compares the address you are about to pay with the one you meant to pay, character by character, and flags look-alikes.
How to make it impossible
- Never copy a destination from your transaction history. Take it from the source: the recipient’s invoice, a verified address-book entry, or a message you already trust.
- Use your wallet’s address book or allowlist for people you pay regularly, and label them.
- Check the whole address, or at least a long stretch in the middle as well as both ends. On a hardware wallet, compare it on the device screen.
- Send a small test for large or first-time payments, and confirm receipt with the recipient through a separate channel.
- Hide zero-value and unknown-token transfers if your wallet or explorer can.