Crypto Address Poisoning Scam: How to Spot and Avoid It

A crypto address poisoning scam plants a fake entry in your transaction history and waits for you to copy it the next time you send cryptocurrency. To avoid it, spot a planted entry and verify the crypto wallet address before you paste it, because a send to the wrong address cannot be undone.

Checked against MetaMask's (opens in a new tab), Trezor's (opens in a new tab), Ledger's (opens in a new tab) and Etherscan's (opens in a new tab) help pages, October 2026.

How an address poisoning attack works

An address poisoning attack starts with a transfer you did not ask for. MetaMask says (opens in a new tab) attackers send you a tiny transaction from an address that closely resembles one you have used before, hoping you copy it by mistake. These transfers are usually transfers of zero tokens, so in a zero value transfer scam the planted entry is a transfer of nothing.

The lookalike uses the same first and last few characters as the real address. MetaMask's example is an address where the first four and last four characters match. Only the middle differs, so a quick look at the ends shows what seems to be the same address.

Seeing one of these entries does not mean your wallet is hacked. Etherscan's help page (opens in a new tab) says that if you see muted token transfers, your wallet is fine and your keys are safe. The danger starts when you copy the fake address and send to it.

As of October 2026, Ledger says (opens in a new tab) address poisoning is most commonly associated with EVM-compatible chains like Ethereum, meaning networks built to work like Ethereum.

How to spot a poisoned entry

As of October 2026, these are the signs to look for in your history or in a block explorer (a website that lists transactions):

• A sender you never actually dealt with, even if it looks familiar.
• A very small amount or a zero amount.
• An address that looks like one of your contacts. Etherscan advises (opens in a new tab) checking the addresses above and below the one you are interacting with in the Token Transfers tab, because scam addresses may appear before or after the real one.
• An entry your app flags. Trezor says (opens in a new tab) Trezor Suite blurs transactions that appear to be address poisoning and marks them as unverified. It also says to disregard transactions Suite flags as suspicious.

Some tools hide the most obvious cases. Etherscan says (opens in a new tab) it hides zero-value transfers by default, and Ledger says (opens in a new tab) its Ledger Live app does the same. Hiding zero-value transfers does not catch a tiny non-zero one. Dust, a very small amount of a coin, is a warning sign but not proof: Etherscan notes (opens in a new tab) that not all dust transfers are poison transfers.

How to verify a crypto wallet address before you send

As of October 2026, this is how their makers describe the wallet features named in these steps. Menus can change, so look for the same setting under a similar name if you do not find it.

1. Get the address from its source

   For your own wallet, open its receive screen and copy the address from there. For another person or a business, ask them to give you the address directly. Avoid copying addresses from your transaction history (opens in a new tab), and do not copy one from a block explorer either.

   Trezor says (opens in a new tab) the same advice applies to your own address, for example when you move funds from an exchange to your Trezor device. If you cannot get the address from its source, do not send.

2. Compare every character

   Paste the address into the send field, then compare the whole pasted address with the one from its source: start, middle and end. Pay particular attention to the middle, where a lookalike differs. If a single character is different, delete it and start again from the source.

   MetaMask says (opens in a new tab) it shows a blocking warning before you submit a transaction to an address that closely resembles one you used before. Not every wallet does this, so do not rely on it.

3. Match the hardware wallet screen

   If you use a hardware wallet (a small device that keeps your keys offline), read the destination address on the device screen before you approve. MetaMask says most hardware wallets require you to confirm the destination address on the device itself. For setup, see how to set up a hardware wallet.

   Trezor says (opens in a new tab) malware on your computer or phone can change what those screens show, but it cannot change what your Trezor shows you. The device cannot tell you whether an address someone gave you is the right one. If you pasted a poisoned address, the device screen shows the poisoned address, so compare the screen with the address from its source, not with your clipboard.

4. Send a small test first

   Before a large amount, send a small test and confirm it arrived. For a payment to someone else, ask them to check their own wallet and tell you, because only they can confirm the address is theirs. If the test does not arrive, or arrives somewhere unexpected, stop and do not send the rest.

   Trezor notes (opens in a new tab) a test means paying the network fee (gas) twice, which may not be feasible depending on the current gas price. Check the fee on the send screen before you decide.

5. Save only a verified address

   After a test arrives, save the address in your wallet's address book so you can pick it from there next time. In MetaMask, open the menu and choose Contacts. Etherscan recommends (opens in a new tab) using your wallet's address book to whitelist frequently used addresses so you know exactly where you are sending funds. On an exchange, the equivalent is an allowlist: see how to secure a crypto exchange account.

For the full sending routine, read how to send crypto to your own wallet.

Example with made-up addresses

This is a made-up history. The addresses are short placeholders, not real ones, and "Coin X" is invented.

1. Day 1: you send 10 Coin X to A1b2 [middle A] 9F3c. Your friend gave you this address directly and confirmed a small test.
2. Day 3: you receive 0 Coin X from A1b2 [middle B] 9F3c. This is the planted entry.
3. Day 4: you receive 5 Coin X from an exchange you use, from a different address.
4. Day 6: you receive 0.0001 Coin X from 7Qd4 [middle C] 2Lm8. Your app flags it.
5. Day 9: you want to pay your friend again.

Entry 2 shares its first four and last four characters with entry 1, and only the middle differs. It is also the most recent entry that looks like your friend, so it is the one a quick copy from history would pick. Entry 4 does not resemble anything you used, which is another reason to ignore it. Check the entries above and below your friend's address, then take the address from your friend, not from this list.

What to do if you already sent to a poisoned address

• Treat the money as gone. Because on-chain transactions cannot be altered once confirmed, MetaMask says (opens in a new tab) the lost funds will be irretrievable. See who can act after a send to the wrong address.
• Save the transaction ID (also called the hash, a unique reference for the send), both addresses, the coin, the amount and the date and time. The US FBI lists (opens in a new tab) these as the transaction details to report.
• If you sent from an exchange, tell the exchange. The US FTC lists (opens in a new tab) the exchange you used among the places to report fraud involving cryptocurrency.
• Report the scam where you live: see where to report a crypto scam.
• Ignore anyone who offers to get the money back, which is a crypto recovery scam pattern. The FBI warns that anyone claiming they can recover your funds may be running another scam.

Risks to understand

• A wrong address-book entry repeats the loss. Every later payment goes to the wrong place until you fix the entry.
• No tool proves an address is safe. A warning can be missed, and Trezor warns (opens in a new tab) that even people who double-check addresses can still fall victim.
• Malware that swaps the address on your clipboard is a different attack. See how to set up a Bitcoin wallet.

Before you move crypto to a wallet of your own, read how to store crypto safely.