An address poisoning scam is an attack where a scammer sends a tiny transaction from a look-alike wallet address to plant it in your history. If you copy that fake address next time you send crypto, your funds go to the attacker permanently. No reversal is possible on a public blockchain.
- Key Takeaway 1: Scammers generate vanity addresses that match the first 4-6 and last 4-6 characters of a real address you trust.
- Key Takeaway 2: The attack works because most wallets display only the start and end of an address, hiding the middle characters.
- Key Takeaway 3: Always verify the full middle section of any address before confirming a transaction, not just the first and last characters.
- Key Takeaway 4: A poisoned dust transaction itself cannot steal funds; the theft only happens if you send to the fake address.
- Key Takeaway 5: Indian investors using platforms like WazirX, CoinDCX, or ZebPay are equally at risk when withdrawing to self-custody wallets.
How Poisoned Addresses Enter Your History
The mechanics of an address poisoning scam are deceptively straightforward. A scammer uses an address-generation tool to brute-force thousands of wallet addresses until they find one whose first and last several characters match a wallet you have recently interacted with. These are called vanity look-alike addresses.
Once they have a matching address, they send a dust transaction to your wallet. Dust means an amount so small it has almost no monetary value, sometimes fractions of a rupee worth of a token. The only purpose of that transaction is to plant the fake address inside your on-chain history.
Here is a visual example of how close these addresses look. Say your real recipient address is:
Real address: 0x4a3B…f7c2D9
Poisoned address: 0x4a3B…f2c9D9
The first four characters 0x4a3B match. The last four characters look almost the same at a glance. But the middle section is completely different, and that middle section is where your money goes. Most wallet UIs compress addresses and show you only the ends, which is exactly what this attack exploits. According to blockchain security firm Cyvers, address poisoning attacks resulted in over $1.2 million in losses in a single month in early 2024. Separately, PeckShield reported that dust-based wallet attacks across Ethereum and BNB Chain caused more than $68 million in total user losses during 2023. Chainalysis data from its 2024 Crypto Crime Report found that address spoofing and impersonation scams collectively accounted for over $1 billion in stolen funds across all chains in 2023.
This scam is closely related to other passive on-chain traps. If you have read our breakdown of what a honeypot token is, you will recognise the pattern: the attacker sets a quiet trap and waits for you to walk into it.
Why Copy-Paste Habits Fail You
The copy-paste crypto scam works because most people have built a habit of copying addresses from their recent transaction history. It feels safe. You sent to that address before, so it must be right. That instinct is exactly what attackers are counting on.
Some malware variants go a step further and actually replace a copied address in your clipboard with the attacker’s address the moment you press Ctrl+C. But address poisoning does not even need malware. It relies entirely on your UI’s address truncation and your own habit of not checking the full string.
Indian crypto users face an additional layer of risk during withdrawals. When moving assets from exchanges like CoinDCX or ZebPay to a hardware wallet or DeFi protocol, users often copy addresses from previous withdrawal records. If a poisoned address appeared in your on-chain history before that withdrawal, you might copy the wrong one without realising it. Under India’s VDA tax rules, a mistaken send is still a taxable disposal event, and you will owe 30% tax on any deemed gains with no deduction for the loss.
Scammers also combine address poisoning with fake airdrops to increase confusion. We have covered how to spot a fake crypto airdrop separately, but the overlap is real: a fake airdrop can also be the vehicle that plants a poisoned address in your history.
Verification Habits That Block the Address Poisoning Trap
The Verify-Middle-Characters Rule
The single most effective habit you can build is this: never trust only the first and last characters of an address. Always expand the full address and verify at least 6-8 characters from the middle of the string before confirming any transaction.
Most wallets and exchanges let you click on a compressed address to see the full version. Make that click non-negotiable. It takes four seconds and it is the only reliable way to catch a look-alike address before it costs you money.
Use Your Address Book, Not Your History
Every serious wallet app, including MetaMask, Trust Wallet, and exchange withdrawal interfaces on WazirX and Mudrex, has an address book or whitelist feature. Save your trusted addresses there with clear labels like “My Ledger – ETH” or “Dad’s WazirX wallet.” Pull from the address book, not from recent transaction history.
Cross-Check on the Block Explorer
Before a large transfer, paste the destination address into Etherscan, BscScan, or Polygonscan and verify it matches your intended recipient’s known address. If you are sending INR-equivalent amounts above Rs 10,000, this 60-second check is worth every second. The 1% TDS on crypto transfers in India applies at source, meaning a wrong send could also trigger a TDS deduction on funds you will never recover.
| Verification Step | Time Required | Blocks Address Poisoning? |
|---|---|---|
| Check first + last 4 chars only | 2 seconds | No |
| Verify full address (all characters) | 10 seconds | Yes |
| Use saved address book entry | 5 seconds | Yes |
| Cross-check on block explorer | 60 seconds | Yes |
| Send a small test transaction first | 2-5 minutes | Yes (high-value sends) |
Wallet Features That Help
Several wallets have started building in native defences against address poisoning. Ledger Live flags addresses that appear suspicious based on dust transaction patterns. MetaMask’s latest versions let you tag and colour-code saved addresses, making it visually harder to confuse them. Hardware wallets display the full destination address on the device screen, giving you a physical second check before signing.
On the exchange side, platforms like CoinDCX allow withdrawal address whitelisting with a 24-hour lock period. That cooldown exists precisely to stop impulsive sends to unverified addresses. Use it.
If you are active in DeFi or trading meme coins, the attack surface is wider. Our meme coin safety checklist covers contract-level risks, but address hygiene applies there too. And if you have ever wondered how on-chain data can be manipulated to mislead users, our explainer on wash trading in crypto shows how bad actors routinely game transaction records.
The broader pattern here is that address poisoning scams exploit trust in on-chain data. Blockchain transactions are public and permanent, but that permanence cuts both ways: scammers can permanently insert misleading data into your history, and you can permanently lose funds by trusting that data without verification.
India’s SEBI and RBI have not issued specific guidance on address poisoning at the time of writing, but CERT-In has flagged clipboard hijacking malware as an active threat to Indian crypto users. The regulatory silence does not reduce your personal risk; it increases the need for individual vigilance.
Frequently Asked Questions
What is an address poisoning scam?
An address poisoning scam is when an attacker sends a near-zero-value transaction to your wallet from an address that closely mimics one you have used before. The fake address then appears in your transaction history. If you copy it instead of your real recipient’s address, your next transfer goes to the attacker. The blockchain cannot reverse it.
How do scammers get fake addresses into my history?
They use automated tools to generate thousands of wallet addresses until they find one whose first and last characters match a known address in your history. They then send a dust transaction from that look-alike address to your wallet, which costs them almost nothing. Your wallet records the incoming transaction, and the fake address is now sitting in your history ready to be copied.
What are vanity look-alike addresses?
Vanity addresses are wallet addresses deliberately generated to match a specific pattern, usually the first and last several characters of a target address. They are not hacked or stolen; they are freshly created to look similar. The attack depends on wallet UIs that compress addresses and show only the ends, making the middle differences invisible unless you look carefully.
How do I verify an address before sending?
Always expand the full address and compare every character, not just the start and end. Save trusted addresses in your wallet’s address book and pull from there. For transfers above Rs 10,000, cross-check the destination on a block explorer like Etherscan. For very large amounts, send a small test transaction first and confirm receipt before sending the full amount.
Can a poisoned transaction itself steal my funds?
No. Receiving a dust transaction, even from a scammer, does not give anyone access to your wallet. The transaction itself is harmless. The theft only happens if you later copy the fake address from your history and voluntarily send funds to it. Your private keys are never exposed by an incoming transaction alone.
Risk Disclosure: Cryptocurrency investments carry significant risk. Funds sent to a wrong address on a public blockchain are unrecoverable. India’s 30% VDA tax and 1% TDS apply regardless of whether a transaction was made in error. Always verify addresses independently before confirming any transfer.
This is not financial advice. Data as of July 2025. Last updated: July 2025. Reviewed by the CryptoWire editorial team.
