Address Poisoning: How Dust Transactions Target Your Wallet

If you copy a wallet address from your transaction history, you might be sending funds to a stranger. That is the essence of address poisoning, a scam that relies not on exploiting smart contracts, but on exploiting how users copy and paste addresses from their own wallets.

Attackers send a tiny amount of cryptocurrency (often less than a dollar, sometimes called "dust") to a target wallet. The transaction appears in the victim's history alongside legitimate transfers. The trick is that the sender's address is crafted to look nearly identical to a frequently used address – for example, starting and ending with the same characters. A user who copies the fake address from the history and sends funds will send them to the attacker, not the intended recipient.

This pattern is not new, but it is growing more common as wallet interfaces remain slow to add visual warnings. Understanding the mechanics, the evidence, and the verification steps can help you avoid losing funds to a simple copy-paste mistake.

Address poisoning is a low-cost, high-reward scam that requires no technical exploit. It works because many users rely on transaction history as a shortcut: they open a wallet, scroll to the last transfer to a friend or exchange, and copy the recipient address. Attackers know this behavior and game it.

The scam is particularly effective on high-value chains like Ethereum, where one misplaced transaction can cost thousands of dollars. Unlike a wallet drainer that requires a malicious signature, address poisoning only needs a moment of inattention. The attacker does not need access to your private keys or seed phrase; they only need your public address and a small gas fee.

Security researchers and blockchain analytics firms have documented address poisoning since at least 2022. Chainalysis, in its 2023 and 2024 crypto crime reports, noted that the scam is part of a broader category of "social engineering" attacks that do not involve code exploitation. SlowMist has published detailed analyses showing how attackers generate addresses with matching start and end characters (e.g., a fake address that starts with "0x" and ends with the same four hex characters as a legitimate address).

MetaMask, in its official support documentation, warns users to "always verify the full address before sending a transaction" and advises against relying on transaction history. The wallet provider explicitly states that it does not filter or flag potentially poisoned addresses, leaving the responsibility on the user.

The table below summarises the key differences between address poisoning and other common wallet-level scams.

The attacker first identifies a target wallet with a history of frequent transactions to a specific address – for example, an exchange deposit address that the user sends to regularly. The attacker then generates a large number of addresses that match the first and last few characters of that legitimate address. This is computationally feasible because the first and last characters are often the same across many addresses (e.g., "0x" start and "abcd" end). The attacker sends a dust transaction from each generated address to the victim's wallet. The dust is so small that many wallets hide it by default or show it in a collapsed "dust" section.

When the victim later needs to send funds again, they scroll through their transaction history, see the fake address (which looks correct at a glance), and copy it. The attacker waits for the incoming transfer. The scam works because the victim's wallet does not flag the fake address as malicious.

You can detect address poisoning before copying an address. Look for these signs:

• A transaction with a very small amount (e.g., 0.0001 ETH) from an unknown address. Many wallets show a separate "dust" category or allow you to hide small transfers.
• The sender address in that transaction appears similar to a known address but has different characters in the middle. Hover over the address or tap to expand it to see the full string.
• The transaction timestamp is often recent, even if you have not interacted with that address recently.
• If you receive a dust transaction from an address you do not recognise, do not copy that address. Instead, use your address book, a trusted contact, or a manually verified address from the exchange's official deposit page.

Always copy the full address from a trusted source, not from your transaction history. Use the exchange's official deposit page, a contact's message verified out of band, or a saved address book entry.
2. If you must use transaction history, expand the address and verify at least the first six and last six characters by eye.
3. Compare the address against a known source: open a new tab and confirm the address on the exchange's official website (not via a link from the transaction).
4. For large transfers, consider sending a test transaction of a small amount first, then confirm receipt before sending the full amount.
5. Use a wallet that supports address-based verification contacts or an ENS name that you can verify independently.
6. Be suspicious of any transaction from an unknown address with a negligible amount – it is likely a poison attempt.
7. If you accidentally send funds to a poisoned address, do not panic. Contact the receiving exchange or service immediately; some may be able to reverse the transaction if it has not been confirmed. Do not engage with anyone claiming they can recover the funds for a fee (that is a common recovery scam).

It is not known how many total wallet addresses have been targeted by address poisoning. Because the scam is passive and many victims never report it, the true scale is likely undercounted. Some researchers have estimated that thousands of addresses are poisoned daily across Ethereum and BSC, but public data is limited.

Another unknown is whether wallet providers will implement automatic warnings. As of mid-2025, MetaMask, Rabby, and other major wallets have not introduced a built-in label for potential poison addresses, leaving detection to third-party tools or user vigilance. The effectiveness of any future mitigation is unproven.

We will monitor wallet provider update notes for any changes to address display or dust warnings. We are also tracking security research that attempts to quantify the success rate of address poisoning – for instance, how many poisoned addresses actually receive funds. If any wallet adds a "poison address" tag or warning, we will update this column and publish a guide on how to use the new feature.

In the meantime, the simplest protection remains the oldest: verify the full address before confirming the transaction. A few seconds of attention can save you from a scam that costs nothing to execute but everything to fall for.