Imagine you open your wallet history to copy an address you have used before, and you paste an address that looks right: same first characters, same last characters, and a recent transaction to match. You hit send, and your funds go to a scammer. That is an address poisoning attack, and it works because wallets show shortened addresses and humans check only the beginning and the end. The attacker never touches your wallet; they just plant a convincing copy of your address in your history.

The attack starts with the scammer watching public transactions. When they see your wallet interact with a familiar address, such as an exchange deposit address or a friend's wallet, they generate a vanity address that shares the same first and last characters. Generating such an address is cheap, because only a few characters need to match: the middle can be anything, and most wallet displays hide the middle behind dots. The scammer then sends a tiny transaction, often zero value or a dust amount, from that lookalike address to your wallet. Now their address sits in your transaction history, right next to the real one.

The trap closes later, when you need that address again. Instead of opening your address book or asking the recipient to resend it, you copy it from your recent history, and your eye lands on the poisoned entry. The first and last characters match what you expect, so you approve the transfer. Because blockchain transactions are irreversible, the funds are gone the moment the transaction confirms, and there is no support desk able to reverse it.

Defending against poisoning is mostly about how you copy addresses. Never copy a receiving address from your transaction history. Use your wallet's saved address book, ask the recipient to send the address again through a trusted channel, and verify the full address, not just the ends, before confirming any large transfer. Many wallets let you label known addresses, which makes the real entry stand out and the poisoned one obvious. For large amounts, send a tiny test transaction first and confirm receipt with the recipient before sending the rest.

Wallet software is also improving here. Some wallets now warn when you paste an address that first appeared in your history through an unsolicited tiny transaction, and some hide zero-value transfers by default. Keep your wallet app updated so you benefit from those protections, and treat any unexpected tiny transaction as suspicious by default: do not interact with it, do not visit links in its memo, and do not assume it came from someone you know.

Address poisoning succeeds because it exploits a normal human shortcut: trusting what looks familiar. Break that shortcut by always sourcing addresses from the recipient or your address book, checking the full string on large transfers, and testing with a small amount first. The attack costs the scammer almost nothing to set up, but it costs you nothing to defeat once you know the trick.

The cheapest defence against address poisoning takes about five seconds and works for every transfer, not just suspicious ones. Before you confirm, read the full receiving address on the confirmation screen, not just the shortened version your wallet shows in history. Compare it against the address in your address book or the message from the recipient, checking the middle characters as well as the ends, since attackers only bother matching the ends. For any transfer that matters, send a tiny test amount first and wait for the recipient to confirm receipt before sending the rest. Five seconds of checking beats the permanent regret of an irreversible transfer, and once the habit is automatic you will never think about it again.