How to Spot an Address Poisoning Attack in Your EVM Wallet
Guide · 19 Sep 2026
Address poisoning is a low-tech trick with a high success rate. It does not break cryptography or exploit a smart contract bug. Instead, it targets a common habit: copying a wallet address from your transaction history because it looks familiar. An attacker creates an address that resembles one you already use, then sends a tiny or zero-value token transfer to your wallet. That fake address now appears in your history. If you later copy it by mistake, your funds go to the attacker. EVM wallets across Ethereum, BNB Chain, Polygon, Arbitrum, and other chains all display this kind of history, so the risk is not limited to one network.
What an address poisoning attack actually does
- The attacker generates many addresses until one matches the first and last few characters of a real address you use.
- They send a small or zero-value transfer—often a fake or unfamiliar token—to your wallet from the lookalike address.
- Your wallet’s transaction history now shows that lookalike address as a recent sender or recipient.
- Because wallets shorten addresses to something like 0x1234...abcd, the lookalike can look identical at a glance.
- The attacker waits for you to copy the wrong address from history when you next send funds.
How to spot a poisoned address in your history
- Unexpected incoming transfers, especially ones with 0 value or tokens you do not recognize.
- An address that resembles a saved contact but is not saved in your address book.
- A sender address that shares the same first four to six characters and last four to six characters as a real address you use.
- The address appears only as an incoming transfer and has no prior outgoing transaction from your wallet.
- Token names or symbols designed to look like a legitimate token you hold.
- On a block explorer, the transfer may show a value of 0 or a very small amount.
The middle characters matter most
Wallets truncate addresses for readability. You see 0x1234...abcd, so you naturally check the beginning and end. Address poisoning exploits exactly that. The attacker’s address will match those visible parts. The difference is almost always in the middle. Before you send anything, expand the full address and compare every character—not just the first and last few. If your wallet shows a checksummed address with mixed capitalization, compare that too. A single wrong character in the middle is enough to send funds to the wrong place.
Safer verification habits before you send
- Never copy a recipient address from your transaction history.
- Use your wallet’s saved address book, a trusted ENS name, or a QR code from a verified source.
- Verify the full address through a separate channel—call, encrypted message, or a known official website.
- If you use ENS, check the resolved address, not just the name, because lookalike ENS names exist.
- Double-check the full 42-character address before confirming any transaction.
- Consider hiding or ignoring suspicious tokens and transfers so they do not clutter your history.
FAQ
What is address poisoning in one sentence?
It is an attack where someone sends a tiny or zero-value transfer from a lookalike address to trick you into copying that address from your wallet history.
Can address poisoning steal funds automatically?
No. The attacker cannot move funds from your wallet just by sending you a token. The attack only works if you later send funds to the lookalike address.
Do I need to do anything if I see a suspicious incoming transfer?
Do not interact with it and do not copy its address. You can hide or ignore the token. If you already sent funds to that address, the transaction is irreversible on-chain.
Shingan is a non-custodial, Telegram-first wallet-security bot for EVM wallets across twelve chains.