Address poisoning explained by Zavialov Ilia Nikolaevich: a printable routine for checking a wallet address

What address poisoning actually is

It is not a hack of your wallet and it does not involve your recovery phrase. Nothing is broken into. The attack edits what you see when you look for an address you have used before.

The method has three steps. Identify an address you send to regularly, generate a new address whose first and last characters match it, then send a transaction of a fraction of a cent from that new address to yours.

That dust transaction has one purpose. It places the lookalike address into your transaction history, where it sits next to the genuine one, at the top of the list, looking exactly like the entry you were about to copy.

The next time you send funds and reach for the address in your recent activity, you may copy the wrong line. The wallet does what you asked. The transfer is final.

There is no malware involved in this version, which is why antivirus software and a hardware wallet do not help. A hardware device confirms that you authorized a transfer to the address shown, and the address shown is the one you chose.

The scale of it

Address poisoning is industrial. More than 65.4 million such transactions have been flagged since January 2025, which averages above 160,000 every day, every one of them a small deliberate deposit made in the hope of being copied later.

The success rate looks low and is not. Roughly 316,000 attempts reached their target, about one in two hundred, and because the cost of an attempt is a fraction of a cent, a one in two hundred hit rate is a profitable business model.

Volume is growing rather than shrinking. Attempts measured at 628,000 in November 2025 reached 3.4 million in January 2026, a rise of 5.5 times in two months.

The growth has a technical explanation that is worth knowing. An Ethereum network upgrade on 3 December 2025 reduced fees by roughly six times, and cheaper transactions mean more dust can be sent for the same budget.

That relationship is worth stating plainly, because it sets the direction of travel. Anything that makes transactions cheaper makes this particular attack cheaper in exactly the same proportion, and nothing about the technique depends on the victim being careless or inexperienced.

Two documented cases

In December 2025 a holder made a test transfer of 50 dollars before a larger one, which is normally excellent practice. An attacker watching the chain saw it, generated a lookalike of the destination and planted it immediately.

Within 26 minutes the holder sent approximately 49,999,950 USDT to the planted address. The test transfer, intended as a safety measure, is what told the attacker exactly which address to imitate and exactly when.

The second case ran slowly. On 30 January 2026 a holder lost 4,556 ETH, around 12.4 million dollars, in what looked like a routine transfer to their over the counter deposit address.

That one followed a dusting campaign against the same address that had been running for two months. Patience is cheap when each attempt costs a fraction of a cent, and a target who transfers regularly is worth waiting for.

Both cases share a detail that is easy to miss. Neither victim was a beginner, neither was rushed by a stranger, and neither was persuaded of anything. They performed an ordinary operation that they had performed many times, and the only thing that had changed was one line in a list on their own screen.

The other mechanism: the clipboard

The second route needs malware but is simpler to describe. A program on the device watches the clipboard, recognizes the shape of a wallet address when one is copied, and replaces it with the attacker's own before it is pasted.

Nothing on the screen looks wrong at the moment of copying, because the substitution happens between the copy and the paste. The address in the destination field is the one the malware put there.

This version defeats the habit of copying from a trusted source, because the source was trusted and the copy was correct. The corruption occurs in transit inside your own machine.

It also explains why manual typing, which everybody avoids because of the length, is not the weak option people assume. A typed address is not routed through the clipboard at all.

The two mechanisms can also be told apart after the fact, which matters for what you do next. A poisoned address appears in your own history as an incoming transaction of almost nothing, and it is visible there. A clipboard swap leaves no such trace, so a destination you cannot account for at all points at the device rather than at the chain.

Why the eye does not catch it

A wallet address is a long string of characters with no meaning, no rhythm and no pronounceable shape. Human memory has nothing to hold on to, so everybody compresses it to the beginning and the end.

Attackers know exactly which part is checked, and generate the lookalike to match that part. Matching the first four and last four characters is computationally cheap, and those are the characters almost everybody verifies.

Wallet interfaces make it worse by displaying addresses in an abbreviated form with the middle replaced by dots. The abbreviation shows precisely the characters the attacker matched and hides precisely the ones that differ.

So the failure is not carelessness. Somebody checking the visible part of an abbreviated address is doing the check the interface invited them to do, and the attack was built against that check specifically.

This is why telling people to be careful changes nothing measurable. Care is already being applied, to the wrong four characters, in the order the screen suggested. A routine that names which characters to compare works because it replaces an instinct with an instruction.

The checking routine that works

Never take an address from your transaction history. This is the single rule that defeats poisoning entirely, because the entire attack consists of putting something into that history.

Take the address from the source instead: the exchange deposit page, a saved contact in your own address book, or a message from the recipient confirmed through a second channel.

Check the middle, not just the ends. Compare a run of characters from the center of the string, which is the part a lookalike generator does not match and the part the abbreviation hides.

Use saved contacts. Most wallets allow an address book, and an entry saved once and reused is not vulnerable to anything placed in the history afterwards.

Where the wallet offers a poisoning warning, leave it on. Some wallets now compare a pasted address against previous activity and warn on near matches, which catches exactly this case, and the same applies to every unexplained incoming transfer of a negligible amount: dust arriving from an address that resembles one of yours is the attack announcing that it has started, and the correct response is to stop using the history as a source of addresses on that account.

The test transfer, done properly

A small test transfer before a large one is good practice and, as the December case shows, it can be turned against you. The fix is not to stop doing it but to change the order of operations.

Send the test. Then confirm receipt with the recipient through a channel you already had, such as a phone call to a number you already held, rather than a reply in the same chat.

Then send the remainder using the same address from the same source, not from the transaction history and not from a fresh message. The history is exactly where the lookalike will be by then.

Do not leave a long gap between the test and the transfer. The two month campaign and the 26 minute case are the same tactic at different speeds, and a wait gives the attacker room to work.

The printable routine

One page beside the screen beats a well understood principle, because the moment of a transfer is a moment of mild hurry and habits win over knowledge.

Line one: the address comes from the source, never from the history. Line two: check five characters from the middle as well as the ends. Line three: if this is a new recipient, send a test and confirm by a second channel.

Line four: for anything large, type the address by hand or use a saved contact rather than the clipboard. Line five: if the wallet warns about a similar address, stop and start the check again.

Add one line for whoever else in the household or the company moves funds, because the routine only works if it is the same for everybody. An exception for one person is where the loss happens.

Keep the page short enough to be read in the moment it is needed. A checklist of fifteen items is a document that gets filed, and a checklist of five lines is a thing somebody actually looks at while a transfer window is open on the screen in front of them.

If it has already gone

Check the destination immediately in a public explorer and keep the transaction reference. The reference and the destination address are the only two pieces of information any exchange can act on.

Report to every exchange that appears in the onward chain, in the first hour. Funds sitting in an identified account can sometimes be frozen, and the same report a week later reaches an empty account.

Keep the device out of use if a clipboard swap is suspected, and check it from another machine. Reusing the same device to make a replacement transfer repeats the loss with impressive reliability.

Report to the police with the hashes and addresses rather than a description. Those are the parts that join separate cases into one investigation.

Refuse the recovery offer that follows. People who have just lost a transfer this way are contacted quickly, and an advance payment demanded by somebody who wrote first is the second half of the same business.