What Is Address Poisoning?

Address poisoning is a scam that exploits transaction history. The attacker generates an address whose first and last characters look almost identical to one you often send funds to, then sends your wallet a zero-value or tiny transfer so the fake address shows up in your history. The next time an operator copies an address from that history, the funds may go straight to the attacker. It requires no system intrusion. It relies on the habit of checking only the start and end of an address and copying addresses from past records.

How Does Address Poisoning Happen?

The attacker first watches the target wallet on-chain and identifies who it transfers to regularly, such as the business’s own cold wallet or a partner’s receiving address. They then generate addresses in bulk until they find a lookalike whose opening and closing characters match the real one. Next, they use it to send the target wallet a transfer, sometimes a zero-value token transfer and sometimes a fake token with the same name, purely so it appears in the transaction history as a familiar counterparty. The technique requires no intrusion and costs very little, yet it keeps working.

Why Do Businesses Fall for Address Poisoning Too?

Businesses transfer often and to fixed counterparties, which makes them exactly the targets attackers want. Crypto addresses are long, many wallets and block explorers show only the first and last few characters, and operators tend to check only the start and end, which is precisely the part a lookalike address is built to fool. Without centralized address management, staff who copy addresses from previous transactions can turn one lapse into a major loss, and on-chain transfers cannot be reversed.

How Can You Spot Address Poisoning?

Address poisoning usually leaves a few clear traces in a wallet. The first is a zero-value transfer from an unfamiliar address, or a transfer so small it has no real purpose. The second is a token with the same name as a common one but a different contract address. The third is two addresses in the transaction history that share the same first and last characters but differ in the middle. Comparing the full address character by character, or checking the token’s contract address, exposes the fake. The problem is that few people do this in daily operations, so once you see these traces, it means your wallet has been targeted and every transfer that follows deserves extra care.

Conclusion

Address poisoning relies not on technical intrusion but on lookalike addresses and the habit of copying addresses from transaction history. Understanding how it works and what traces it leaves is the first step for businesses to prevent address poisoning. Safeheron’s Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Want to know whether your business wallet has been targeted by address poisoning? Contact Safeheron’s Sales Team to Book a 1:1 Demo