Address Poisoning: How Not to Send Money to a Scammer by Copying an Address from Your History

In short

• Address poisoning (“address poisoning”) is a scheme in which a scammer sends you an empty or tiny transfer from an address that resembles one you work with. The similar address appears in your history, and on your next transfer you copy it instead of the real one.
• The scale is enormous: Trust Wallet counted more than 225 million such attacks and more than $500 million in stolen funds. In December 2025, one user lost 49,999,950 USDT, and in January 2026 another lost $12.25 million.
• A test transfer does not save you: the victim who lost $50 million tested the correct address, but sent the main amount to the fake one a few minutes later.
• The main rule: never copy an address from your transaction history. Use an address book, a whitelist, and verify the entire address.

Address poisoning does not require hacking a wallet, malware, or your signature. The scammer simply relies on habit: most people verify an address by its first and last characters. In this article — how the scheme works, why even experienced traders fall for it, and how to set up protection in 10 minutes.

How address poisoning works

1. The scammer monitors the blockchain. Bots identify wallets with large regular transfers of USDT, USDC, or ETH.
2. Generates a similar address. Specialized software creates an address whose first and last characters match the address you frequently send funds to.
3. “Poisons” the history. From a similar address, your wallet receives a transfer of 0 USDT, a tiny amount, or a fake token named USDT. Your transaction history now contains an entry that looks like your usual counterparty.
4. Waits for a mistake. On your next transfer, you open the history, copy the “familiar” address, and send the money to the scammer.

The scheme operates on Ethereum, Tron, BNB Chain, and other networks. Lower fees only make it more widespread: the attacks are sent out automatically, and according to Trust Wallet, around 34,000 are launched per hour.

Real cases

The first case was described by Cointelegraph: the scammer immediately swapped USDT for ETH, dispersed it across wallets, and partially sent it through Tornado Cash. The second was reported by BeInCrypto, citing data from Scam Sniffer.

Why a test transfer doesn’t help

The test checks only one specific transfer. If after that you copy the address from your history again, and a scammer has managed to “poison” it in those few minutes, the main amount will be sent to someone else’s address. Bots react to test transfers almost instantly: they see a small send — and immediately slip in a similar-looking address.

The test transaction only works if you send the main amount to the same address selected from the address book, rather than copying it again.

How to protect yourself from address poisoning: step by step

1. Never copy an address from transaction history. Not in a wallet, not in a block explorer, and not on an exchange.
2. Create an address book. Save the addresses you send to regularly with clear names: “Bybit deposit”, “Ledger main”. Choose the recipient only from the address book.
3. Enable a whitelist on the exchange. Withdrawals will only be possible to pre-saved addresses.
4. Verify the entire address. Not just the first and last characters, but the whole string. For large amounts, check it character by character, in sections.
5. Get the address from the original source. Copy the deposit address from the exchange page, and a friend’s address from the message they sent you, not from history.
6. Hide zero-value and spam transactions. Many wallets have a setting that hides 0-value transfers and unknown tokens.
7. Check the address on the hardware wallet screen. The device shows the recipient address that is actually being signed — compare it with the address book.

Which wallets are already protected

Since March 2026, Trust Wallet has been checking the recipient address in real time across 32 EVM networks, including Ethereum, BNB Chain, Polygon, Base, and Arbitrum. If an address resembles a known fraudulent one, the wallet displays a warning with a comparison of the two addresses. The protection is enabled by default, Trust Wallet reports.

Such warnings are useful, but they do not replace good habits. Databases of fraudulent addresses cannot keep up with new ones, so an address book and full verification remain the main protection.

If you have already sent money to a “poisoned” address

1. Document the transaction. Save the hash, amount, time, and both addresses.
2. If it is USDT or USDC, act quickly. The issuer may freeze the funds at the request of law enforcement before the scammer exchanges them. File a report with the cyber police the same day.
3. Notify the exchange if the scammer may withdraw the funds through it. Major exchanges flag related addresses.
4. Do not contact “fund recovery specialists.” This is a second layer of fraud.
5. Switch to a new wallet for large amounts. The “tainted” history will remain, and the next mistake is only a matter of time.

If you sent coins not to a scammer but to the wrong network, that is a different situation: see the guide sent USDT to the wrong network. Which wallet to choose for large amounts — in the review of the best cryptocurrency wallets.

Risks

• The attack does not require any security mistake on your part. A single copied address from your history is enough.
• Wallet warnings do not catch everything. New addresses appear faster than they are added to databases.
• Small amounts are also at risk. Bots poison transaction history at scale, not only for whales.
• Major news amplifies attacks. Exchange hacks, airdrops, and mass withdrawals from exchanges are times of heightened attention: scammers become more active in sending poisoned transfers.

FAQ

What is address poisoning in simple terms?

This is a fraudulent scheme in which an attacker sends an empty or tiny transfer to your wallet from an address that resembles one you normally use. The fake address then appears in your transaction history, and you may copy it instead of the real one.

Why is my wallet receiving 0 USDT transfers from unknown addresses?

Most likely, this is an address poisoning attempt. The scammer “poisons” the history so that you copy a similar address. Such transfers do not steal funds by themselves, but the addresses from them must not be used.

Is it dangerous to receive zero-value transactions?

No, not by themselves: they do not provide access to the wallet. The danger is that you may copy the sender’s address during your next transfer. Hide such transactions in your wallet settings and do not interact with unknown tokens.

Does a test transaction help against address poisoning?

Only if you send the main amount to the same address selected from the address book. If, after the test, you copy the address again from the history, a scammer may have time to “poison” it.

Can money sent to a fake address be recovered?

Blockchain transactions are irreversible. There is only a chance with stablecoins: the issuer of USDT or USDC can freeze the funds at the request of law enforcement if you file a report quickly.

How can you verify that the address is correct?

Choose an address from the address book or whitelist, obtain it from the original source, and verify the entire string, not just the beginning and the end. On a hardware wallet, verify the address on the device screen.