Address poisoning is a scam in which an attacker places a lookalike address in your wallet’s transaction history, often through a tiny or zero-value transfer. The goal is to make you copy that address for a later payment. Never treat a recent history entry as proof of the recipient. Get the destination from a trusted source and compare the full address before confirming.
A surprise incoming transaction does not by itself mean your wallet has been compromised. If you have already sent to the wrong address, stop further transfers, save the TXID and contact the sending and receiving services through official channels. Confirmed blockchain transfers may be irreversible. No person asking for a recovery phrase or “release fee” can reverse one.
How does a poisoned address get into my history?
- You make a real transfer or publish a wallet address. Public-chain activity lets others see some addresses you use.
- An attacker creates another address that matches the beginning and end of a familiar address but differs in the middle.
- They send a tiny or zero-value transaction so their address appears near your legitimate activity. Some wallets may display a zero-value token event as if it were a transfer.
- Later, you copy a destination from history and accidentally paste the attacker’s address into a new send.
MetaMask’s address-poisoning guidance describes the lookalike-history pattern. Ledger’s technical explanation shows why even a zero-value token event can add a deceptive history entry. The transfer that causes loss is the later payment you choose to sign to the wrong address, not the arrival of an unwanted dust transaction.
What should I check before sending?
On a narrow screen, scroll the table sideways to see all columns.
| Step | Action | Why it matters |
|---|---|---|
| 1. Start from the recipient | Open the destination in the recipient’s own wallet or the receiving service’s current deposit page. | Your transaction history is an attacker-controlled discovery surface. |
| 2. Match asset and network | Confirm the exact token, chain and any memo/tag required by the receiver. | A correct-looking address on the wrong route can still cause loss. |
| 3. Compare the full address | Check the entire pasted string against the trusted source, including the middle characters. Recheck the final confirmation screen or hardware-wallet display. | A poison address is built to pass first-and-last-character checks. |
| 4. Review the final send | Read destination, network, asset, amount and fees before authorising. If anything differs, cancel and investigate. | Clipboard changes, stale deposit instructions and address poisoning can all show up here. |
A saved contact can reduce repeated copying only if you verified it when saving and recheck it when the recipient changes. A small test transfer can limit the size of one mistake but cannot authenticate the address by itself: repeat the full-address check before any later, larger send. Use the transfer checklist for an asset/network/memo review.
Worked example: the middle is different
Suppose you previously paid a recipient whose address is shown as 0x8A31…91F2. A new zero-value entry appears with the same shortened display. You inspect both full addresses and find that the middle characters differ. The matching prefix and suffix are not confirmation. Get a fresh address from the recipient’s trusted channel, compare every character in the send preview, then decide whether to proceed. These snippets are illustrative, not usable wallet addresses.
What if I see a suspicious transaction?
Do not copy its address, click links in its token name, or interact with a suspicious NFT or contract to “clean” your wallet. Verify whether the activity is an incoming transfer, an outgoing transaction you authorised or a token approval. A zero-value entry alone is different from an unauthorised outgoing payment. If there is an outgoing transfer you did not authorise, follow your wallet provider’s compromise guidance promptly and consider whether approvals or keys are exposed; the token approval guide explains one separate permission risk. For a suspicious prompt or recovery offer, use the offer safety checklist.
What if I already sent to the wrong address?
Save the on-chain transaction hash (TXID), network, recipient address and UTC time. Contact the sending wallet or exchange and the intended receiving service through their official support pages. If an exchange withdrawal is still internal and has no on-chain TXID, the sender may be able to clarify its status; once a transfer is confirmed to an attacker-controlled address, recovery is generally unlikely. Do not pay a third party promising guaranteed retrieval or disclose a recovery phrase to anyone.
Sources and scope
This guide follows MetaMask’s user guidance and Ledger’s analysis of vanity and zero-value poisoning. Wallet warnings vary by product and version. The safest habit is independent verification of the full destination at the moment of sending, even when your wallet flags some lookalikes automatically.
See how crypto.tt sources and reviews guides. Check current network and service instructions before acting.