Crypto address poisoning is a scam that exploits a simple human habit: copying wallet addresses from transaction history instead of verifying them fresh. Attackers send you a tiny, worthless transaction from an address that closely resembles one you use regularly, often matching the first and last few characters. Later, when you copy an address from your recent transactions to send funds, you may accidentally pick the attacker's lookalike address, and your crypto goes to the scammer instead of your intended recipient.

The trick relies on how wallets display addresses. Full blockchain addresses are long strings of letters and numbers that nobody memorises, so wallets show shortened versions with only the start and end visible. Attackers generate addresses, sometimes called vanity addresses, that match a victim's frequent contact on those visible characters, then send a dust transaction, often worthless or a fraction of a cent, so the poisoned address appears in the victim's history. Because the dust transaction looks like ordinary activity, most users never notice it until they copy the wrong address.

The scam is particularly dangerous because everything else about the transaction feels normal. You are sending to an address you recognise, from your own wallet, with your own approval, so no security warning fires. The loss is usually discovered only when the intended recipient reports non-receipt, by which time the funds are gone and blockchain transactions cannot be reversed. Attackers automate this at scale, poisoning thousands of histories with lookalike addresses and waiting for a fraction of victims to copy the wrong one.

Protection starts with one rule: never copy a recipient address from transaction history. Always obtain the address fresh from the recipient through a trusted channel, or use your wallet's saved address book for frequent contacts, which stores the full verified address. When you paste an address, verify the full string character by character, not just the first and last few characters, and use your wallet's checksum or QR code features where available. Sending a small test transaction before a large transfer is a cheap insurance policy that catches addressing errors before they become expensive.

Wallet and exchange features can help. Some wallets now warn when you paste an address that first appeared in your history through a tiny incoming transaction, and some highlight addresses that closely resemble your frequent contacts. Enable these warnings where available, and consider using human-readable naming services, such as ENS names, for frequent recipients, since a verified name is far harder to spoof than a string of characters. Keep your transaction history habits tidy: ignore or hide dust transactions from unknown senders rather than interacting with them.

If you realise you sent funds to a poisoned address, act quickly but understand the limits. Check the transaction on a block explorer to confirm the destination, and contact your wallet provider and the relevant exchange if the funds moved onward, though recovery is unlikely once the attacker controls the address. Report the poisoned address to scam databases and community channels so others can be warned. Do not engage with anyone offering to recover the funds for a fee, as recovery scams target victims a second time. Most importantly, fix the habit that caused the loss: switch to address book entries and test transactions for all future sends, so the same mistake cannot repeat.

Address poisoning succeeds because it targets attention, not technology. The blockchain worked exactly as designed; the error was human, copying a familiar-looking string without full verification. Building a slow, deliberate sending routine, verify the full address, use the address book, test large transfers, is the only reliable defence, and it costs seconds per transaction. This article is educational only and not financial advice; always double-check addresses before sending, because crypto transactions are generally irreversible.