Avoid Address Poisoning Attacks: Step-by-Step

DeFi Intel Research · Updated 2026-07-02 · beginner

Imagine you're about to send a large cryptocurrency transaction. You copy what you think is your recipient's address from your transaction history—a familiar string you've used before. You paste it, double-check the first few and last few characters, and hit send. Days later, you discover the funds never arrived. The address you used was a cleverly crafted lookalike, planted in your history by an attacker. This is an address poisoning attack, a subtle but devastating form of crypto theft.

In this step-by-step guide, you'll learn exactly how address poisoning works and, more importantly, how to protect yourself. We'll cover concrete, beginner-friendly techniques: why you should never copy from history, how to verify the full address, the power of whitelists, and other must-know practices. By the end, you'll have a robust mental checklist to prevent this attack and keep your funds safe.

Understanding Address Poisoning Attacks

Address poisoning, also known as address spoofing, is a targeted attack where a malicious actor generates a cryptocurrency address that closely resembles a legitimate address you have transacted with. The attacker then sends a dust transaction (a tiny amount of crypto) to your wallet from this lookalike address. This poisons your transaction history, because your wallet now shows that fake address as a previous counterparty.

When you later need to send funds to that same legitimate recipient, you might hastily copy the fake address from your history instead of the real one. The critical point is that the first few and last few characters of the addresses often match exactly, making casual checks deceptive. Unlike many scams, address poisoning doesn't require you to click a malicious link or share a private key—it exploits trust in your own history. Understand this mechanism: the attacker invests a tiny amount (the dust) to increase the chance you'll mis-copy. The real defense is to never rely on transaction history as a source of addresses.

The Copy-From-History Trap: Why You Should Never Do It

The easiest and most common way victims fall to address poisoning is by copying a recipient's address from their past transaction history. This is exactly what attackers count on. They know that many users, especially when sending to frequent contacts, take the shortcut of reusing an old transaction detail rather than obtaining a fresh address.

Consider this scenario: you send ETH to a friend. Later, the attacker sends you 0 ETH from a lookalike address that starts and ends with the same characters as your friend's. Your wallet groups this under the same contact. Next time you send to your friend, you see two nearly identical addresses in your history. If you pick the wrong one, the transaction is irreversible. The solution is simple but requires discipline: never, ever copy an address from your transaction history. Always obtain the address directly from the recipient via a trusted, independent channel (e.g., their website, a secure message, or in person).

"Your transaction history is a minefield of lookalike addresses. Treat every address in your history as potentially poisoned until verified independently."

Always Verify the Full Address — Not Just the First and Last Characters

Many users are taught to check only the first few and last few characters of a crypto address. Attackers exploit this by generating vanity addresses that match those characters. For example, a legitimate Ethereum address starting with 0xAbC… and ending with …1234 might be mimicked by 0xAbD…1234. At a glance, they look identical.

The cure: verify the entire address, character by character. This is tedious for long addresses, but it's the only way to be 100% sure. Use tools that help: highlight and compare each segment. Some wallets allow you to display the full address in large font—use that. Alternatively, you can read the address out loud to a second party over a secure call. Another trick: after pasting, select the entire address and copy it again, then paste into a text editor that shows monospaced characters, and manually compare it against the known correct address from a trusted source. Never rely on truncated displays or 'matched first/last' checks; those are exactly what attackers exploit.

Use a Whitelist or Address Book Feature

Most modern wallets and exchanges offer a whitelist (also called an address book or allowlist). This feature allows you to save trusted addresses with a label. Once an address is whitelisted, you can send to it without manually typing or pasting a full address—you simply select the labeled entry. This eliminates the risk of copying from history or falling for a lookalike.

How to use it effectively: Before your first transaction to a new recipient, add their address to your whitelist. Verify the address multiple times before saving. For extra security, some platforms require a time delay or multiple confirmations before adding a new address. Always check that the whitelisted address matches exactly what the recipient provided. Never modify an existing whitelist entry without re-verification through an independent channel. Using a whitelist is one of the single most effective defenses against address poisoning because it bypasses your transaction history entirely.

Send a Small Test Transaction First

Before sending a large amount, always send a small test transaction to confirm the address is correct. This simple step can save you from catastrophic loss. If you're using a whitelist, first send 0.001 ETH (or equivalent) to the new address and confirm with the recipient that they received it.

This technique is especially important when dealing with a new recipient or after a period of inactivity. It also helps catch errors like sending to a wrong chain (e.g., Ethereum mainnet vs. BSC). While test transactions cost a small fee (the network gas), that fee is negligible compared to losing the entire transfer. For high-value transfers, consider sending two test amounts: one very small and one moderate, ensuring each is confirmed before the next. The key is to verify after the test that the address you used matches what the recipient actually controls. Don't rely on the transaction receipt alone—ask the recipient to confirm. This adds friction but adds near-zero risk of poisoning.

"Test transactions are the cheapest insurance you can buy in crypto. A few cents in gas can save thousands of dollars."

Leverage Hardware Wallet Displays and Multi-Signature Wallets

Hardware wallets (like Ledger, Trezor, or KeepKey) display the receiving address directly on the device's screen. Since this screen is separate from your computer or phone, it cannot be altered by malware that might have infected your device. Always use the hardware wallet's own display to verify the full address before confirming a transaction. This is the gold standard for address verification.

For even higher security, consider using a multi-signature (multisig) wallet, such as Gnosis Safe. Multisig requires multiple private keys to approve a transaction. Even if one signer's transaction history is poisoned, the other signers can catch the mistake before the transaction executes. This adds a layer of human verification that thwarts single-point-of-failure attacks. While multisig is more complex, it's ideal for teams, DAOs, or high-value personal holdings. Combined with hardware wallet displays, address poisoning becomes nearly impossible.

Double-Check via a Second, Independent Source

Never rely solely on a single source for a recipient's address. If you receive an address via email, a chat message, or a website, verify it through another trusted channel. For example, if your friend sends you their address on Telegram, call them or use an encrypted message service like Signal to confirm. If you're sending to a business, check their official website, then cross-check the address listed on a blockchain explorer like Etherscan for that known entity.

Public sources like Etherscan can also be used to look up a known name or contract. However, beware of phishing sites that mimic explorers — always verify the URL. A useful habit: maintain a personal, offline list (e.g., a password manager's notes) of addresses you use frequently, and refer to that list instead of your transaction history. The more independent channels you use to confirm an address, the lower the chance of being poisoned. This principle is called "defense in depth" and applies perfectly to crypto security.

Browser Extensions and Risk Awareness

Some browser extensions claim to help manage addresses or display transaction history. Be cautious: malicious extensions can modify addresses in your clipboard, replacing a legitimate address with a poisoned one just before you paste. This is a variant of clipboard hijacking.

To protect against this: use a dedicated hardware wallet with its own screen; avoid extensions that request clipboard access; and always verify the address after pasting, using the hardware wallet display or a manual read-aloud. Additionally, keep your browser and extensions updated, and only install extensions from reputable sources with good reviews. When using web wallets, consider using a separate browser profile or incognito mode for crypto transactions to reduce extension interference. Ultimately, trust the device that you physically control—your hardware wallet—over any software on your computer.

Conclusion: Build Your Defense-in-Depth Habit

Address poisoning attacks are deceptively simple, but with the right habits you can make them harmless. The core rule: never copy an address from transaction history. Always obtain the address fresh from a trusted source, verify it completely, and use tools like whitelists and hardware wallet displays.

Just as importantly, adopt the test transaction habit. Send a tiny amount first. Over time, these steps become automatic, and the risk of losing funds to a poisoned address drops to near zero. Stay vigilant, protect your transaction history by ignoring it for address sourcing, and share this knowledge with others. Crypto security is a community effort.

Frequently asked questions

Related reading

• Sandwich Attack
• Wallet