Address Poisoning: How Fake Transactions Trick Crypto Wallets – CryptoRescue Author Column

Address poisoning, also called a “sand attack” or “wallet poisoning,” is a low-cost, high-accuracy scam that exploits the public nature of blockchain transactions. Unlike a phishing link or a fake app, this attack does not require the victim to click anything or download malware. It works by sending a tiny, nearly valueless transaction from a wallet address that closely resembles one the victim has previously transacted with. The goal is to trick the victim into copying that fake address from their transaction history and sending a large amount of crypto to the scammer instead of the intended recipient.

This column is not a breaking news report. It is a source-backed analysis of how address poisoning works, what the evidence shows, how users can verify addresses before sending, and what remains uncertain about the scale and detection of these attacks.

Address poisoning matters because it targets a common user habit: copying a recipient address from a previous transaction rather than obtaining it fresh from a trusted source. Many people reuse addresses, especially for frequent interactions with exchanges, friends, or smart contracts. The blockchain explorer or wallet interface shows the last few transactions, and a poisoned address sitting in that history can look identical at a glance.

The FBI’s Internet Crime Complaint Center (IC3) issued a public service announcement in August 2022 warning about “address poisoning” scams, noting that scammers use blockchain transactions to “poison” the victim’s transaction history. The IC3 PSA remains one of the most authoritative official sources on this pattern. SlowMist, a blockchain security firm, has published technical analyses showing how attackers generate vanity addresses that match the first and last few characters of a real address, making the fake address visually indistinguishable from the legitimate one in most wallet interfaces.

Because the attack does not require any compromise of the wallet itself, traditional security advice – “never share your private key” – does not prevent it. The only reliable defense is habit: always verify the full address, not just the first and last four characters.

The IC3 PSA describes the attack as follows: scammers send a small amount of cryptocurrency (often 0 ETH or a dust token) from a lookalike address to the victim’s address. The victim later sees that transaction in their history and, when they need to send funds to the same recipient, they copy the poisoned address from the history instead of the real one. The FBI confirms that victims have lost substantial amounts – sums ranging from several thousand dollars to over a million dollars – in such attacks.

SlowMist’s analysis adds technical detail: attackers use algorithms to generate addresses that match the first and last 4–6 characters of a target address. For example, a legitimate address like `0x1234...abcd` might be mimicked by `0x1234...abce` (note the last character change). The tool can generate thousands of candidate addresses per second, and the attacker then sends a dust transaction from each generated address that happens to be unspent, hoping the victim will eventually use one of those addresses.

CoinDesk reported a January 2023 case where a victim lost $1.2 million in an address poisoning attack. The article notes that the attacker used a “dust” transaction of 0.0001 ETH to “seed” the victim’s wallet history. This is consistent with the pattern described by the FBI and SlowMist.

Source-tracked CryptoRescue article.

The scammer identifies a high-value wallet address from a public transaction, often from a known exchange or a whale wallet.
2. Using a script, the scammer generates a new wallet address that closely matches the first and last few characters of the victim’s address.
3. The scammer sends a negligible amount of crypto (often 0 ETH or a dust token) from the new fake address to the victim’s address. This transaction appears in the victim’s transaction history.
4. When the victim later initiates a transfer to the same recipient (e.g., depositing to an exchange), they may copy the fake address from the history instead of the real one.
5. The funds are sent to the scammer’s address, which is often a temporary address that immediately forwards the funds to a mixer or exchange.

The key enabler is that most wallet interfaces show only the first and last few characters of an address, truncating the middle. A user seeing `0x1234...abcd` in their history may not notice that the poisoned address is `0x1234...abce` – especially if they are not meticulously checking every character.

Users can check for address poisoning by looking at their transaction history for any tiny or zero-value incoming transactions from unknown addresses. These are often from addresses that look similar to addresses the user has interacted with before. However, note that legitimate dust transactions also exist (e.g., airdrops, spam tokens), so not every small transaction is a poisoning attempt.

The most reliable signal is a mismatch in the full address when compared to the intended recipient’s address. If you always use a saved address in your wallet’s address book (not a fresh copy from history), you are safe. If you must copy from history, compare the full address character by character.

• Check the full address character by character, not just the first and last 4–6 characters.
• Use a saved address in your wallet’s address book or a trusted contact list – never copy from transaction history.
• Before sending a large amount, send a small test transaction and confirm the recipient received it.
• If you receive a tiny or zero-value transaction from an unknown address, do not assume it is a legitimate airdrop. Mark it as spam or ignore it.
• Use a hardware wallet with a display that shows the full address for confirmation.
• Avoid reusing addresses for frequent transactions; generate a new address for each deposit if possible.
• If you use a multi-sig or smart contract wallet, verify recipient addresses on a block explorer before signing.

While the FBI and security firms have documented the mechanism, several aspects remain uncertain:

• The actual total number of victims and total losses. The IC3 PSAs are based on complaints, but many victims may not report or may not realize they were poisoned.
• The effectiveness of wallet-level warnings. Some wallets now flag lookalike addresses, but adoption is uneven.
• Whether address poisoning is being combined with other attacks (e.g., phishing to obtain the victim’s address in the first place, or social engineering to initiate a transaction).
• The role of automated address generation scripts. SlowMist’s analysis shows that attackers can generate many addresses, but the exact number of active poisoning campaigns is unknown.

Source-tracked CryptoRescue article.

Wallet interface improvements that make lookalike addresses more visible (e.g., color coding, full address display options).
2. New blockchain explorer tools that allow users to detect and flag poisoned addresses in their transaction history.
3. Law enforcement actions against address poisoning networks, which could provide more data on the scale of the problem.

If you suspect you have been targeted by an address poisoning attack, do not interact with the suspicious address. Instead, verify all outgoing transactions and consider using a dedicated address for each counterparty. For further guidance, see CryptoRescue’s wiki page on transaction verification and our guide to preserving evidence after a crypto theft.