Address Poisoning: How Fake Lookalike Addresses Trick EVM Users
Guide · 28 Sep 2026
A cryptocurrency address is a 42-character string, and most of us never read all of it. Wallets and block explorers shorten addresses to something like 0x1a2b…9f3c because the full string is unreadable. Address poisoning is an attack that exploits exactly that habit. It doesn't break cryptography or steal private keys. Instead, an attacker places a lookalike address where you are most likely to copy it — your own transaction history — and waits for you to send funds to the wrong place.
How the Attack Works
The attacker generates a wallet address whose first few and last few characters match an address you already transact with. Because those are the characters wallets display, the fake looks familiar at a glance.
They then send a tiny or zero-value transfer from that lookalike address to your wallet. On many networks this costs the attacker very little. The result is a new entry in your history that looks like it came from a legitimate counterparty.
Days or weeks later, when you want to send funds to that counterparty, you scroll your history, copy the address you see, and paste it into your wallet. If you copied the attacker's entry, the money goes to them.
Some variants work the other way: the attacker creates an address resembling *your* address and sends dust to people you transact with, hoping they will save the wrong address for you.
Why Truncation Is the Weak Point
- Wallets show the first four to six and last four to six characters. The middle — the part that actually differs — is hidden.
- Identical prefixes and suffixes create a strong feeling of recognition that bypasses careful checking.
- Copy-paste makes the mistake easy: you rarely retype or compare an address once it looks right.
- Attackers monitor the network and can act quickly after you interact with a new counterparty, so the poisoning entry may appear soon after a real transaction.
Warning Signs
- An unexpected incoming transfer of a tiny amount, or a zero-value token transfer, from an address you don't recognize.
- A history entry whose first and last characters match a known contact but which you cannot tie to a real transaction.
- Two similar-looking entries in the same history — one real, one fake.
- Tokens in your wallet you never asked for (these can also be unrelated spam or bait).
- A "known" address that appears in your history but not in your saved contacts.
How to Protect Yourself
- Never copy a destination address from your transaction history. Use a saved address book, a verified contact, or a name service you have already confirmed.
- Compare the full address, not the ends. If your wallet or hardware device shows the whole string, read the middle characters too.
- Verify a new address on a block explorer before the first payment, and bookmark that explorer page.
- Confirm the address on your hardware wallet screen, which displays the full string.
- Use a small test transfer before sending a large amount to any new address.
- Hide or ignore zero-value and unknown-token transfers rather than interacting with them.
- When someone sends you an address by message, confirm it through a second channel.
- Remember that receiving an unwanted token does not mean you have been hacked — only signing or sending can move your funds.
FAQ
Is address poisoning a hack of my wallet?
No. The attacker does not access your keys or your device. The attack depends on you copying the wrong address and approving the payment yourself.
Can I reverse a payment sent to a poisoned address?
No. Once a transaction is confirmed, it is final. There is no chargeback mechanism on EVM networks, and the attacker controls the receiving address.
Do zero-value transfers cost me anything?
Usually not — the attacker pays the network fee to create the entry. The danger is not the transfer itself but the address it plants in your history. Avoid interacting with unfamiliar tokens or addresses that appear without explanation.
Tools can help you stay alert here: Shingan is a non-custodial, Telegram-first wallet-security bot for EVM wallets across twelve chains.