Address poisoning is when scammers send tiny transactions from a wallet address crafted to look almost identical to one you've used before, so it shows up in your transaction history. If you later copy an address from that history without checking it fully, you might paste the scammer's look-alike instead of the real one. Always verify the complete address, not just the first and last few characters, before confirming a transfer. Using saved contacts or address books instead of copy-pasting from history can also reduce this risk.
How the Trap Is Set
Every wallet address is a long string of letters and numbers, and most people only glance at the first few and last few characters to confirm it looks right. Scammers exploit this habit. They generate a wallet address that shares those same starting and ending characters as one you have genuinely transacted with before, then send a tiny, often worthless amount of crypto from that look-alike address to your wallet. That transaction now sits in your transaction history, looking like just another interaction with someone you have dealt with previously.
The scammer is betting on a simple human shortcut. If you ever need to send funds to that contact again and you pull the address from your history instead of typing it fresh or using a saved contact, you may grab the poisoned address instead of the real one. Because the beginning and end match what you expect, nothing looks obviously wrong at a glance.
Why This Works So Well
Blockchain addresses are long and not memorable, so people rely on pattern recognition rather than reading every character. Scammers understand this and use software that can generate addresses matching a desired prefix and suffix, sometimes called vanity address generation. This means they do not need to guess your exact address, only craft one similar enough to fool a quick visual check.
The attack also works because sending that tiny poisoning transaction costs very little, while the potential payoff if a victim later sends a large amount to the fake address can be significant. It is a low cost, high leverage scam that does not require hacking your wallet or stealing your private keys. It simply exploits a moment of inattention during a routine transfer.
How Traders Can Spot and Avoid It
The most reliable defense is to verify the entire address character by character, not just the first few and last few digits, every time before confirming a transfer. This feels tedious but takes only a few extra seconds and closes the exact gap scammers are counting on.
Using a saved address book or verified contact list inside a wallet, rather than copying addresses from transaction history, removes much of the risk because you are pulling from a source you trust rather than one that could contain planted entries. Some traders also cross-check a new or unfamiliar-looking address against a previous confirmed source, such as a message or record from the actual recipient, before sending any meaningful amount.
Sending a small test transaction before a larger transfer is another common practice, though it only helps if you are also confirming the address independently rather than assuming history is accurate.
Limitations and Broader Risk Management
Address poisoning does not steal funds directly from your wallet, and it cannot succeed unless you yourself copy and send to the fake address. This means awareness and careful habits are the core defense, not any particular tool or indicator. No wallet feature can fully substitute for actually checking what you are sending to.
This scam is a reminder that crypto risk is not only about market moves or trading strategy. Operational habits, like how you store contacts, how you verify addresses, and how much attention you give to routine steps, matter just as much as chart analysis or position sizing. Treating every transfer, even to a familiar looking address, as worth a brief independent check is a simple habit that meaningfully reduces exposure to this kind of scam.