Address Poisoning: How Lookalike Addresses Trick EVM Wallets
Guide · 07 Oct 2026
Address poisoning is a patient, low-cost trick. Nobody breaks into your wallet, cracks a key, or exploits a contract. An attacker gets a lookalike address into your transaction history, then waits — sometimes for months — until you copy that address instead of the real one when sending funds. The theft happens at the moment you paste, not at the moment they sent.
How the attack works
- The attacker generates an address whose first and last characters match an address you already transact with. Vanity-address generators can search huge numbers of keys cheaply, on ordinary hardware.
- From that lookalike address, they send your wallet a zero-value or dust transfer, occasionally a junk token or NFT instead.
- The transfer lands in your history. Most wallets and explorers display it truncated, like
0x1a2b…9f0c. - Later, you owe that counterparty again. You scroll back through history, tap the entry that looks right, and paste it into the send field.
The real address and the fake one look identical everywhere the interface truncates them. If both share the first six and last four characters, a glance, a screenshot, or a quick "does it match?" check all say yes.
Why it works so well
Truncation is the whole engine of the attack. Interfaces show a few leading characters and a few trailing ones, because that's usually enough to tell addresses apart. Poisoning flips that assumption: the attacker copies exactly the part you're used to comparing.
The attack also scales. It costs only gas, so it runs in bulk across Ethereum, L2s, and other low-fee EVM chains. Common targets are people who pay the same counterparties repeatedly — exchange deposit addresses, contractors, payroll and treasury wallets — because a repeat payment is what makes you reach for history in the first place.
One variant sends from an address that mimics *your own* address, so a poisoned entry reads like a self-transfer.
How to spot a poisoned address
- Open the full string. Tap into the transaction on a block explorer and read every character, not the shortened label.
- Compare the middle, not just the ends. Check the leading characters, the trailing characters, and a random chunk from the centre, such as characters 12–20.
- Watch for unexpected dust. A tiny or zero-value incoming transfer from an address that resembles someone you know is the signature of this attack. Treat it as noise and never as confirmation.
- Check checksum capitalisation. Many tools render addresses in mixed case (an EIP-55 checksum). A lookalike won't often match the capitalisation everywhere — but it can, so treat it as one extra clue, not a verdict.
- Be suspicious of spam tokens and NFTs. Their metadata often contains links. Don't visit them and don't sign anything in response.
- Verify on the destination device. A hardware wallet screen shows the receiving address independently of your computer. Compare there, character by character, before approving.
Habits that remove the risk
The attack depends on you copying an address from a contaminated history. Remove the copy step and it largely stops working.
- Save any counterparty you pay more than once into your wallet's address book, and send only from saved entries.
- Never copy a destination address from transaction history, a chat message, or a screenshot.
- Send a small test amount first, confirm it arrives, then send the rest.
- Confirm the address on your signing device, not just on your screen.
- ENS names are easier to eyeball than hex, but lookalike names exist and resolution still produces an address — verify the resolved address the first time.
- If you spot a poisoned entry, label the genuine address immediately and assume your history is now unreliable.
FAQ
Did I lose funds if a lookalike address sent me a zero-value transfer?
No. Receiving a transfer gives nobody access to your wallet; it only writes a line into your history. The danger is entirely in what you do next. Don't interact with any token or link that arrived with it, and don't let that entry become your default copy target.
I think I already sent funds to a poisoned address. What now?
On-chain transfers are final and there is no reversal mechanism. If the destination was a real exchange deposit address, contact that exchange's support with the transaction hash; otherwise assume the funds are unrecoverable. Also check your machine for clipboard malware, which is a related problem, and review any token approvals or signatures you granted recently.
Do address books and ENS names make me safe?
They help, but neither is proof. Address books eliminate the copy-paste step, which is the core risk, so save anyone you transact with repeatedly. ENS names are easier to verify by eye than hex, but lookalike names exist, so confirm the resolved address the first time you use one. Shingan, a non-custodial, Telegram-first wallet-security bot for EVM wallets across twelve chains, focuses on checks like these.