Address Poisoning Scam: How It Works and How to Stay Safe

I opened MetaMask one evening and saw a USDT transfer I never made. My stomach dropped.

For a second I was sure I’d been drained. I hadn’t been — and that gap between the panic and the truth is the whole point of the address poisoning scam. By the end of this you’ll understand exactly what that fake transfer is, why it cannot move your money on its own, and the short routine I now run before I ever hit send.

Here’s the plan: I’ll map the mechanism in plain English, show you where the trap actually springs, give you a table to tell it apart from other wallet attacks, and hand you a five-minute prevention checklist. No code required. I can’t read Solidity either.

The One-Line Version, Before the Panic

Let me kill the fear first, because that’s what the attacker is renting.

The attack does not touch your keys. It does not spend your balance. It does not need your approval or your seed phrase. All it does is drop a fake transaction into your history so a look-alike address sits there, waiting.

The danger is not the fake transaction. The danger is you, next week, scrolling your history and copying that address by muscle memory.

Address poisoning is a crypto scam where an attacker seeds a look-alike wallet address into your transaction history — usually through a zero-value or tiny “dust” transfer — hoping you later copy that address from your history and send real funds to it by mistake. The poisoning itself moves nothing; the loss only happens on your next copy-paste, and on-chain transfers are irreversible.

Read that twice. The exploit isn’t in the blockchain. It’s in the way we all copy-paste addresses we half-recognize.

How Address Poisoning Actually Works

Now the map. There are three moving pieces, and once you see how they connect, the whole scam stops being mysterious.

Piece one: the look-alike address. Wallet addresses are long strings like 0x7a3f...9c2E. Nobody reads the whole thing. We glance at the first four characters and the last four, and if they match, we trust it. Attackers know this. They run a vanity address generator — software that spits out addresses until one lands with the same first and last characters as an address you use often. The middle is completely different. But the middle is the part your eyes skip.

Piece two: getting it into your history. This is the clever bit. The attacker sends a transaction from that look-alike address to your address — or crafts one that appears to. With standard ERC-20 tokens, the transferFrom function emits a “Transfer” event even when the amount is zero. So for the price of a little gas, anyone can create a fake, zero-value record that shows up in your wallet and on the block explorer as if you interacted with that address.

Piece three: the wait. The attacker does nothing else. The poisoned entry just sits in your history, looking like a real past transaction. Days later you go to send USDT to your exchange, or to a friend, or to your own cold wallet. You scroll history to grab the address you “used last time.” You copy the poisoned one. First four match. Last four match. You send. It’s gone, and because on-chain transactions are immutable, no one can reverse it.

That’s the entire attack. No hack. No malware. No stolen key. Just your own copy-paste, weaponized.

Notice what the attacker never gets: your private key, your seed phrase, or any spending permission. This scam is a social trick dressed up as a technical one. It borrows the credibility of your own history and lets your habits do the stealing. The chain never gets tricked at all — you do.

There’s a second reason this works on smart people. Wallet interfaces truncate addresses on purpose, showing 0x7a3f…9c2E instead of the full string, because the full string is unreadable. That truncation is helpful ninety-nine times out of a hundred. This scam is built entirely around the one time it isn’t.

The zero-value transfer, in plain words

The phrase you’ll see is zero-value transfer or zero-transfer phishing. It sounds technical. It just means: a transaction that moves nothing but still writes a line into your history. A dust attack is the near-identical cousin — the attacker sends a tiny but non-zero amount (a fraction of a cent) instead of zero, to look more like a genuine transfer. Same goal, same defense.

If you want to see one of these for yourself, you can trace any suspicious entry on a block explorer. My walkthrough on how to track a crypto wallet covers reading transaction history line by line, which is exactly the skill that defuses this.

What Poisoning Is Not: A Comparison Table

Here’s where beginners get tangled. “I saw a weird transaction” could mean three very different threats, and they need different responses. Confusing them is how you either panic over nothing or ignore something real.

The most common mix-up is with clipboard-hijacking malware — a virus that silently swaps the address in your clipboard after you copy a real one. That’s a different animal. Poisoning bets on your eyes; clipboard malware bets on software running on your machine. And neither is the same as a token-approval drain, where you signed a permission earlier and an attacker spends against it.

Attack	What it plants	What it needs to steal	What stops it
Address poisoning	A look-alike address in your transaction history	You to copy that address and send funds	Never copy from history; use an address book; verify the middle
Clipboard-hijacking malware	Malware on your device that swaps your clipboard	Malware installed + you pasting without checking	Antivirus; verify the pasted address before signing
Token-approval drain	A signed spending permission you granted a contract	A prior approval you clicked; no new action from you	Revoke stale approvals; read what you sign

The approval drain is the one that can move funds without a fresh mistake from you, which makes it more dangerous in a quiet way. I unpacked that one separately in how token approvals drain wallets and how to revoke them — worth reading, because the fix is completely different. Poisoning you defeat by changing a habit. Approvals you defeat by auditing permissions.

Put simply: the poisoning trick is a trap for your fingers. The other two are traps for your software and your past clicks.

Where I Was Almost Wrong

Here’s my honest near-miss, and it’s smaller and dumber than any horror story you’ve read.

A few weeks after I saw that phantom USDT transfer, I went to move some stablecoins to my hardware wallet. My habit — the same one you probably have — was to open history, find the last send to my cold wallet, and copy that address. Faster than digging up the real one.

I copied it. I pasted it. First four characters matched. Last four matched. My thumb was on the confirm button.

Then I stopped, because I’d just spent an evening reading about this exact trick. I checked the middle. It was fine that time — it was genuinely my old address. But the point is: I almost trusted history reflexively, one week after learning the scam that exploits exactly that reflex. Knowing the mechanism didn’t protect me. Changing the habit did.

That’s when it clicked that the defense isn’t knowledge. It’s a routine that removes the copy-from-history step entirely. So I built one.

I’ll admit the routine felt like overkill the first three times. Sending a $1 test before a real transfer feels paranoid when you’re in a hurry after work. But irreversible is irreversible. There’s no support line, no chargeback, no “I meant the other address.” Paranoid is the correct setting.

The Five-Minute Protection Checklist

This is the part the big explainers bury. Here’s the exact routine I run now. None of it needs coding, and most of it is a one-time setup.

1. Verify the middle, not just the ends. The attacker matched your first and last characters on purpose. Read four or more characters from the middle of the address, every time. This single habit defeats the whole scam.
2. Save verified addresses to your address book. In MetaMask, add addresses you send to often as Contacts. On a hardware wallet like Ledger, use the whitelist. Then send from the saved contact — never from history.
3. Never copy an address from your transaction history. History is exactly where the poison lives. Treat it as read-only. If the address isn’t in your address book, get it from the real source (the exchange page, the person, your own wallet’s receive screen).
4. Send a small test transaction for anything new or large. Move $1 first. Confirm it lands. Then send the rest. The test fee is trivially cheaper than sending your whole balance to a stranger.
5. Use ENS names where you can. A human-readable name like yourname.eth is far harder to spoof than a hex string, because you’re matching a word, not skimming characters. Not every recipient has one, but use them when they do.

Do the first three and you’ve closed the door on almost every look-alike address scam that exists. The test transaction and ENS are belt-and-suspenders.

For the official versions of this guidance, MetaMask’s address-poisoning support doc and Ledger Academy both back up the address-book-and-verify approach, and Etherscan’s info center explains the zero-value transfer mechanics in detail.

One Korean-office-worker detail, since I can’t help it: I keep my address book the way I keep my company expense receipts — one verified entry, saved once, never re-typed. The mistake in both cases is always re-entering something you already had.

What to Actually Do When You See a Poisoned Transaction

You’ve found one in your history. Here’s the calm version of the response.

First, breathe — your funds are fine. Seeing a fake transfer means an attacker spent a little gas to bait you, nothing more. Your balance, keys, and seed phrase are untouched.

Second, do not move your funds in a panic. There’s no need. Poisoning doesn’t compromise your wallet, so scrambling to a new wallet solves nothing and often creates a fresh chance to fat-finger an address.

Third, mark the fake address in your head as poison, and don’t interact with it. Don’t send it a “test,” don’t reply, don’t do anything. Just build your address book and stop copying from history. The threat is neutralized the moment your habit changes.

If you’re curious, open the fake transaction on a block explorer and read the amount. On a real zero-value poisoning attempt, it will say 0. Nothing left your wallet. Seeing that zero with your own eyes does more for your nerves than any reassurance I can write here, and it trains you to spot the next one instantly. A dust variant will show a fraction of a cent instead — same story, nothing you authorized.

I keep a private note with a one-line rule for moments like this: “history is a diary, not a phone book.” A diary records what happened. You don’t dial numbers out of a diary. That framing has done more to protect me than any single tool, because it fixes the behavior this scam depends on.

If you want the wider picture of scam red flags across crypto — not just this one trick — my breakdown of how to spot a rug pull sits in the same wallet-hygiene cluster. Poisoning is one node in a system of habits, not an isolated bogeyman.

FAQ

What is an address poisoning scam? It’s a crypto scam where an attacker plants a look-alike wallet address into your transaction history using a zero-value or dust transfer. The address matches your usual one’s first and last characters, so you copy it later by mistake and send real funds to the attacker. The poisoning itself steals nothing.

Can address poisoning drain my wallet directly? No. Address poisoning cannot move your funds on its own. It doesn’t touch your private keys, balance, or approvals. The only loss happens if you later copy the fake address from your history and send funds to it yourself. That’s why changing your copy-paste habit is the entire defense.

How do scammers get my wallet address? They don’t need anything private. Every wallet address and transaction is public on the blockchain. Attackers scan public activity, find addresses that transact often, then generate a look-alike and send it a zero-value transfer. No hack, no leak, and no access to your wallet is involved at any point.

Why does a fake USDT transfer appear in my transaction history? Standard ERC-20 tokens emit a “Transfer” event even when the amount is zero, so anyone can create a fake USDT record for the cost of gas. The transfer shows up in your history and on the block explorer, but no tokens actually moved. It’s bait, planted to survive until your next send.

Should I move my funds if my address was poisoned? No. Your wallet isn’t compromised, so moving funds fixes nothing and risks a new mistake. Instead, save your real recipient addresses to an address book, verify the middle characters, and stop copying from history. The poisoned entry is harmless as long as you never send to it.

How do I avoid address poisoning going forward? Verify the middle characters of every address, not just the ends. Save trusted addresses to MetaMask Contacts or a hardware-wallet whitelist and send from there. Never copy an address from your transaction history. Send a $1 test before large transfers, and use ENS names when the recipient has one.

Is a dust attack the same as address poisoning? They’re close cousins. A dust attack sends a tiny non-zero amount to your wallet; address poisoning often uses a zero-value transfer with a look-alike address. Both aim to appear in your history and nudge a future mistake. The same defenses — address book, verify the middle, no copying from history — stop both.

The Real Exploit Isn’t On-Chain

Every explainer tells you this attack is a clever blockchain trick. It isn’t, really. The chain is doing exactly what it’s designed to do: record what happened, permanently, for a fee anyone can pay.

The exploit lives in your muscle memory — the reflex to copy an address you half-recognize from a list. Fix the reflex, and the cleverest look-alike address on-chain is just a dead line of text in your history. Everything in this post is one habit wearing five different clothes: stop trusting your own transaction history.

Next in this Wallet Security series, I’ll trace a poisoned address on an explorer end to end, so you can see the zero-value transfer with your own eyes and confirm, every time, that nothing actually moved.

---

seonjae — Korean office worker documenting his transition into AI systems, agents, and vibe coding — without a CS background. Shipping in public.