Address poisoning: the wrong address is already in your history

How the trick works

A crypto address is long, and nobody reads all of it. A Bitcoin address runs to around forty characters, an Ethereum address to forty-two, and the universal habit is to check the first four or five and the last four or five and call it a match. Wallets and explorers encourage this by displaying addresses as 0x1a2b…9f8e. The scam is built on that abbreviation.

The attacker watches the chain for an address that transacts regularly with another, say your wallet sending to an exchange or a casino deposit address. Then they generate wallets by the million until one appears whose first and last characters match the real destination; this is cheap, because generating a key pair costs almost nothing and only a few characters have to line up. From that look-alike they send your wallet a tiny amount, or a zero-value token transfer, which costs them a fee and nothing else. On some networks a token contract will happily record a transfer of zero from your address to theirs, so the entry can even appear as something you sent.

Now your history contains two addresses that look identical in every list that abbreviates. The genuine one, from your real transfers, and the poison, from a transfer you never noticed. The attacker does nothing more. They wait for the day you are in a hurry, open the history, find the last transfer to the exchange, copy the address from the row that happens to be the poison, and send.

The 1,155 bitcoin

The case that made the scam famous happened in early May 2024. A wallet holding wrapped bitcoin on Ethereum sent a small test transfer to a new address, and minutes later sent 1,155 WBTC, worth roughly seventy million dollars at the time, to what the owner believed was the same address. It was not. The test had gone to the real destination; in between, a poisoned transfer had appeared in the history from an address matching it at both ends, and the large transfer was copied from that row.

What followed was unusual. The victim posted an on-chain message offering a bounty, blockchain analysts traced the funds as they were swapped and moved, and about ten days later the attacker returned nearly all of it in ether. That ending is the exception. In the ordinary case the transfer is simply gone, because a blockchain transaction has no reversal, no chargeback and no counterparty who can be asked. Tether has occasionally frozen stablecoins sent to known scam addresses, which is a property of that one issuer’s contract and not of the chain.

The test transfer proved the address was right. The large transfer was copied from a different row.what went wrong, in two sentences

The lesson is not that the victim was careless. They did the recommended thing, a small test first. The scam defeated the test because the test verified one copy of the address and the real transfer used another. Any defence that checks the address once and then trusts the clipboard, the history or the autocomplete afterwards has the same hole.

Where an address comes from here

On this site the deposit address is not something you have ever typed, and it is not something to find in a history. Open the wallet, choose the coin and the network, and the deposit window asks the wallet service for the address that belongs to your account on that network. It shows the full string, a copy button that writes exactly that string to your clipboard, and a QR code that encodes the same string for a phone wallet. If the coin needs a destination tag or memo, the tag is shown in its own field with its own copy button, and the address alone is not enough; the network article explains why.

That gives you a single source of truth for the receiving end: the window that fetched it. The sending end is your own wallet, and that is where the habit has to change, because the site cannot see what you paste there.

The rules

• Never copy a receiving address from a transaction history. Not yours, not an explorer’s. Copy it from the place that issued it: the deposit window here, the receive screen of your own wallet, the address the counterparty sent you through a channel you trust.
• Check the middle, not just the ends. Poisoned addresses are built to match the first and last characters. Read a block of characters from the middle of the string as well, or compare the whole thing side by side.
• Use a whitelist if your wallet or exchange has one. A saved address that was verified once and can only be changed with a delay defeats the clipboard trick entirely.
• Treat unexpected tiny or zero-value transfers as a flag, not a gift. They are the poison being planted. Do not interact with them and do not copy anything from those rows.
• Send a small test, then send the real amount from the same source of the address, not from the test’s history row. The test proves the address you copied; it does not bless whatever you copy next.
• Remember what a confirmation is. Once the transfer is confirmed, it is final, and no support desk on either side can pull it back.