How to Detect Address-Poisoning Attacks
How address poisoning works in 2026, how to detect it in your wallet history, and how to never copy-paste from history.
What you'll need (prerequisites)
- Self-custodial wallet
- A second device for verification
- Block explorer (Etherscan, Solscan, etc.) familiarity
Recommended for this tutorial
Tools and accounts referenced in the steps below:
Step-by-step
-
Step 1: Understand what address poisoning is
Address poisoning is a scam where an attacker sends a $0 transfer, dust, or a fake token from a wallet whose address closely resembles one you regularly send to. The goal is to plant that lookalike entry into your transaction history so you later copy it by mistake. On ERC-20 chains attackers can even trigger zero-value transfers that appear to come from your own address, using a quirk of transferFrom, making the fake entry look legitimate.
-
Step 2: Never copy a destination address from your transaction history
The entire attack relies on you copying a recently used address straight out of your wallet or explorer history. Break that habit: treat transaction history as a record, never as a source of addresses to send to. Copy the destination only from the recipient directly — their message, their invoice, or their own verified channel.
-
Step 3: Verify the full address, not just the first and last few characters
Poisoning addresses are vanity-generated to match the first and last four to six characters of a real one — exactly the shortened form most wallets display. Always check the entire string character by character, or at least several characters in the middle. Two addresses that share only their prefix and suffix are almost never the same address.
-
Step 4: Use a saved address book, allowlist, or ENS name instead of pasting
Store counterparties you use repeatedly in your wallet's address book or an allowlist, and select from there rather than pasting each time. A human-readable name such as an ENS (.eth) name or a verified label removes the raw hex from the equation entirely. Confirm any address once, out-of-band with the recipient, before you save it.
-
Step 5: Send a small test transaction before a large one
For any large or first-time transfer, send a tiny amount first and confirm with the recipient that it arrived at the correct address. The few cents of gas is trivial insurance against sending the full amount to a poisoned lookalike. Only proceed with the full transfer once the test has been confirmed.
-
Step 6: Enable wallet warnings and double-check on the explorer
Modern wallets and suites such as Trezor Suite, MetaMask, and Etherscan flag or blur suspected poisoning transfers and let you hide zero-value token transfers — turn these features on. Before signing, paste the destination into a block explorer to confirm it is the address you expect and has genuine prior history with you. When anything looks off, stop and re-verify the address from its original source.
Common errors and fixes
- Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
- Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
- Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
- Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
- Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.
FAQ
What is a zero-value transfer and why is it in my history?
Attackers exploit that an ERC-20 transferFrom with a zero amount emits a valid Transfer event without needing your approval, so anyone can push a $0 transaction from a lookalike address into your history for only the price of gas. It is placed there to bait you into copying the wrong address later.
How do lookalike addresses actually fool people?
The attacker grinds out an address whose first and last characters match one you already use, betting that you only glance at the ends. When you later copy a recent address from your transaction history you paste theirs instead, so always verify the entire string, not just the start and finish.
What is the safest way to reuse a recipient address?
Never copy an address out of your transaction history. Save trusted recipients in your wallet's address book (or a password manager) after verifying them once, and select from there. For a brand-new recipient, confirm the full address over a second channel such as a call or message.
Should I send a test transaction first?
For large or first-time transfers, yes. Send a small amount, confirm the recipient received it at the correct address, then send the rest. The tiny extra gas cost is cheap insurance against an irreversible transfer to an attacker's lookalike address.
Does receiving a poisoning transfer mean my wallet is compromised?
No. A zero-value or dust transfer does not move your funds or give anyone access to your wallet; it only pollutes your history. You can safely ignore or hide it. The only real danger is copying the attacker's address yourself when you next send.