Prevent Address Poisoning: Complete Guide
You’re about to send a significant amount of crypto. You tap your transaction history, copy the address you’ve used a dozen times, paste it into the send field, and confirm. Later, you realize the funds never arrived — they went to a look-alike address planted by a scammer. This is address poisoning, a deceptively simple attack that exploits a common habit: copying addresses from transaction history.
In this guide, you’ll learn exactly how address poisoning works, why dust attacks are so effective, and — most importantly — three concrete tactics to defend yourself: checking your full address history, leveraging Ethereum Name Service (ENS) names, and always verifying with a first transaction. These steps are non-negotiable for anyone who manages crypto wallets, whether you're a DeFi power user or a casual sender.
- Before any transaction, scroll through your full wallet history and look for zero-value incoming transfers from unfamiliar addresses — those are dust attacks.
- Always verify the intended recipient's address on a block explorer to confirm it has outgoing transactions to you, not just incoming dust.
- Use Ethereum Name Service (ENS) names for all frequent contacts; they make look-alike hex strings impossible to confuse.
- Send a small test transaction to any new or suspicious address before sending a large amount.
- Maintain a whitelist or external address book (password manager or hardware wallet contacts) to avoid relying on potentially poisoned wallet history.
- If you detect poisoning in your history, manually type addresses from a trusted source and consider creating a fresh wallet if contamination is extensive.
What Is Address Poisoning? The Dust Attack Explained
Address poisoning is a social engineering attack in which a scammer sends a microscopic amount of crypto (often 0 or near-zero value tokens) to your wallet from a carefully crafted address that closely resembles an address you have transacted with before. The poison does not compromise your wallet security — it only pollutes your transaction history. The next time you go to send funds, your wallet UI may show the poisoned address alongside the legitimate one, and a moment of inattention is all it takes to copy the wrong string.
| Type | Example Address (first 6 & last 4 chars) | Explanation |
|---|---|---|
| Legitimate | 0xAbcD...1234 | Your trusted contact's real address |
| Poisoned | 0xAbcD...1234 | Scammer's look-alike address: the same first and last characters, only the hidden middle differs |
Notice that in a truncated view both addresses look identical. Attackers brute-force a vanity address that matches the visible first and last characters, so only the hidden middle differs — a quick glance at a small screen or a hurried copy-paste can easily miss this. The scammer profits when you accidentally send to their address instead of the intended recipient. Crucially, the poisoned address must exist on-chain — the scammer typically creates many look-alike addresses and sprinkles dust to wallets they find through a block explorer.
Why Dust Attacks Work: The Psychology of Speed and Familiarity
Dust attacks exploit cognitive biases that even experienced users cannot entirely eliminate. The first is familiarity: we recognize an address by its beginning and ending characters. When we see a string that looks like one we've used before, our brain fills in the rest — often incorrectly. The second is urgency: in fast-moving markets or time-sensitive DeFi operations, people want to “just send it” rather than double-check every character. The third is muscle memory: if you always copy from history, a single poisoned entry becomes a trap you lay for yourself.
“The most dangerous attacks don’t exploit bugs in code, but bugs in human psychology — and address poisoning is a textbook example.”
Because the attack doesn't require any contract exploit or private key compromise, it's often overlooked in security checklists. Victims assume their wallet is “safe” because no money was taken directly. But the real damage happens later, when the poisoned history leads to a catastrophic copy-paste error. Understanding this psychology is the first step toward building habits that override autopilot.
The Golden Rule: Always Check the Full Address History
Before sending any transaction, scroll through your wallet's entire transaction list — not just the most recent few entries. Look for any incoming transfers of 0 or near-zero amounts from addresses you do not recognize. These are dust attacks. On a block explorer (e.g., Etherscan), you can examine the full history of an address you intend to send to. A legitimate recipient address will show outgoing transactions to you from previous interactions. A poisoned address will show only the dust transfer it sent to you — a one-way inbound transaction with no prior relationship.
- Step 1: Open the address in a block explorer.
- Step 2: Filter for outgoing transactions from that address to your own. If none exist, it's likely a poison address.
- Step 3: If you see multiple tiny inbound transfers from similar-looking addresses, each is a poison attempt. Never copy any of them.
This habit takes only 30 seconds but can save you thousands of dollars. Make it part of your pre-send routine, especially for large amounts.
Leverage ENS to Bypass Address Confusion
The Ethereum Name Service (ENS) maps human-readable names (e.g., vitalik.eth) to hexadecimal addresses. If both you and your counterparty use ENS, you can completely avoid copying raw hex strings. Instead of scrolling through history to find 0xAbcD...1234, you simply type theirname.eth and the wallet resolves it on chain. This eliminates the surface for address look-alike attacks because a name like vitalik.eth and vltalik.eth are more obviously different than two hex strings.
However, ENS is not a silver bullet. Scammers can register similar-sounding names (e.g., etherscan.eth vs. etherscam.eth). Always verify that the ENS name matches the exact domain you expect — ideally from a trusted source like a personal bookmark or a verified Twitter account. Many wallets also display a “reverse record” showing the ENS name associated with an address. Enable this feature so you see the name alongside the address in your history — it makes a poisoned address stand out because it will have no reverse record.
Verify the First Transaction: A Non-Negotiable Habit
Every time you send to a new address — or even a seemingly familiar address that you haven't used in a while — send a small test transaction first. This is the single most effective way to catch a poisoned address because you see the actual on-chain result before committing large funds. If you sent the test to the wrong address, you lose only the test amount (plus gas). If the test arrives correctly, you can confidently send the full amount.
- For frequent recipients: After the test transaction succeeds, bookmark the address in your wallet's contact list or a password manager. Never rely on transaction history again for that recipient.
- For DeFi protocols: When depositing to a new contract, use the protocol's official website or app interface — never copy an address from an old transaction unless you have manually verified it against a trusted source.
This habit is especially important when using mobile wallets, where screen real estate is limited and addresses are truncated in ways that hide differences. A test transaction costs a few cents in gas but protects everything in your wallet.
Advanced Wallet Hygiene: Whitelists, Bookmarks, and Address Books
Beyond the three core defenses, you can harden your wallet setup with additional layers. Whitelist addresses you frequently interact with using a multisig wallet like Gnosis Safe. The whitelist only allows transactions to approved addresses, making it impossible to send to a poisoned address even if you copy it by accident. Bookmark your most important addresses outside your wallet UI — in a password manager, a secure note, or a hardware wallet's contact list. This gives you a trusted reference to compare against.
For hardware wallet users: always verify the address on the device's screen before confirming. Some wallet interfaces may show a poisoned address in the history, but the hardware wallet displays the exact output address. Match the last few characters on the device with the address you intended. Never rely solely on the wallet UI's transaction history — it is exactly what the attacker is manipulating.
Finally, consider using a block explorer's watch list feature for your own addresses. Set up alerts for any incoming dust transfers so you can identify poison attempts in real time and block them from your view.
What to Do If You Suspect Your Address Has Been Poisoned
If you discover a suspicious dust transaction in your history, do not panic. Your private keys are safe, and your existing balances are untouched. However, the risk of future loss is real. Follow these steps:
- Inventory all dust transfers: Use a block explorer to list every incoming transaction from unknown addresses. Note the sender addresses and amounts. They are your poison addresses.
- Do not copy any address from your transaction history until you have verified it against a trusted source (e.g., a manual check on a block explorer or an ENS name you manually typed).
- For frequent recipients: If you have a contact with whom you transact regularly, ask them to confirm their address via a secure channel (e.g., encrypted message or voice call). Then bookmark that address.
- Consider a new wallet: If your history is heavily polluted with many poison addresses, creating a fresh wallet and moving your funds can simplify security. Generate a new seed phrase and transfer your assets. This is overkill in most cases but can be prudent for high-value wallets.
Remember that once you confirm a transaction to a poisoned address, the funds are irrecoverable. Prevention is your only reliable defense.
Conclusion: Building a Sustainable Security Routine
Address poisoning is a low-tech, high-impact scam that preys on a single moment of inattention. The good news is that it's entirely preventable with three simple habits: check your full address history before copying anything, use ENS names to eliminate hex confusion, and always send a test transaction first. Add to that basic wallet hygiene — whitelists, bookmarks, and device-level verification — and you close the door on dust attacks completely.
Security is not a one-time setup; it's a routine you practice with every transaction. Start today. The next time you open your wallet to send funds, pause for thirty seconds, apply these checks, and then confirm. That pause could be the difference between a successful transfer and a devastating loss.
Frequently asked questions
What is address poisoning in crypto?
Address poisoning is a scam where an attacker sends a tiny amount of crypto (dust) to your wallet from a look-alike address. Your wallet's transaction history then shows that address alongside your real contacts, tricking you into copying the wrong one when making a payment.
Can address poisoning be reversed?
No. Once you send funds to a poisoned address, the transaction is irreversible on the blockchain. The attack itself (the dust transfer) cannot be undone, but you can delete the dust from your wallet's view to avoid future confusion.
Does using ENS completely prevent address poisoning?
No, but it greatly reduces the risk. ENS replaces hex strings with readable names, but attackers can register similar-sounding names. Always verify the exact ENS name from a trusted source and check the reverse record on block explorers.
Should I delete the dust tokens sent in a poisoning attack?
It's not necessary, but you can hide or mark them as spam in your wallet UI. Deleting them does not remove the transaction from the blockchain; just avoid copying that address.
What if I already sent funds to a poisoned address?
The transaction is irreversible. Report the incident to the platform or exchange you intended to send to (if applicable), secure your wallet by changing any keys or seed phrases used, and review your security habits to prevent recurrence. Consider it a costly lesson in address verification.
Related reading
Track the entities behind the concepts
DeFi Intel maps 11,000+ protocols, tokens and companies to a typed knowledge graph — with live data, incidents and regulation.