An address poisoning scam slips a fake, near-identical wallet address into your transaction history and then waits for you to copy it by accident. There’s no malware involved, and nobody has to steal your password. All the scammer needs is for you to glance at the start and end of an address and assume the rest matches.
Anyone holding stablecoins or moving money around on Ethereum-style chains is squarely in the firing line. Below we’ll walk through the mechanics, the damage it’s already done, and what MetaMask, Trezor, Ledger and Etherscan have built to fight back, before finishing on the handful of habits that actually shut it down.
Table of contents
So What Is Address Poisoning, Exactly?
In MetaMask’s words, it’s a scam in which someone sends you a tiny transaction from an address that looks very much like one you’ve already used. Etherscan describes the same thing from the other end, with the attacker stuffing fake transactions into your history so that you end up paying them. Trezor mentions that you’ll also hear it called address spoofing.
Why does it work so well? Addresses are miserable to read.
The researchers behind a USENIX Security 2025 paper point out that an address on Ethereum or BNB Smart Chain is a 40-digit hexadecimal string. Nobody remembers that.
People reach for their recent transactions and copy from there, and that’s the habit the scam feeds on. For a refresher on the basics, our piece on what a wallet address is starts from zero.
A Few Words You’ll Keep Seeing
- You’ll see vanity address a lot. It means an address generated to fit a pattern someone picked, and scammers run vanity address generators until the opening and closing characters line up with an address you know.
- With a zero-value transfer, 0 tokens change hands. Nothing moves, yet the entry still lands in your history.
- Somebody doing token spoofing puts out a fake token contract whose name and symbol look like a famous token’s.
- An EVM network is any chain that runs smart contracts compatible with Ethereum’s, BNB Smart Chain, Polygon and Avalanche among them.
How an Address Poisoning Scam Plays Out
It happens in four steps. Your keys and your seed phrase stay out of it the whole time.
- Software on the scammer’s side keeps an eye on token transfers, mostly stablecoins. According to Etherscan they’re looking for big transfers, and they can respond inside a few minutes.
- Next comes a vanity address built so its first and last characters copy either your own address or one you paid lately. MetaMask says the usual match is four characters at the front and four at the back.
- That lookalike then sends something to your wallet, whether it’s a sliver of crypto, a zero-value transfer, or a counterfeit token dressed up as a real one.
- Later you want to pay that same contact, so you scroll back through your history, grab the wrong line, and the money heads straight to the scammer.
Picture somebody sneaking a fake number into the recent calls list on your phone, where only the digits in the middle are different, so it looks fine unless you really stare at it.
That Sneaky Zero-Value Transfer
Here’s the version we find most unsettling, because the scammer doesn’t have to own a single one of your tokens. Back in April 2023, Ledger showed that calling transferFrom with a value of 0 on an ERC-20 contract drops a transfer event into your history, and you never approved anything.
So your history appears to show you sending 0 USDT to the lookalike. Etherscan files this under event spoofing, alongside address spoofing and token spoofing.
What Address Poisoning Can Cost You
You can lose the money for good. Send crypto to the wrong address, or over the wrong network, and it’s gone, because nobody can reverse a blockchain transaction. There isn’t a bank to ring or a chargeback form to fill in.
How big is this? Bigger than most people assume.
Taro Tsuchiya, Jin-Dong Dong, Kyle Soska and Nicolas Christin tracked two years of Ethereum and BSC activity for their USENIX Security 2025 paper. They counted 270 million on-chain attack attempts against 17 million victims, plus 6,633 incidents that did at least $83.8 million in damage.
It kept going into 2026, too, with MetaMask reporting in June 2026 that Blockaid had flagged 65.4 million address poisoning attempts between January 2025 and February 2026.
Cases That Actually Happened
- Etherscan notes an August 2023 case where $20M went to a spoofed address by mistake.
- Chainalysis reports that on May 3, 2024, someone on Ethereum sent roughly $68 million worth of Wrapped Bitcoin (WBTC) to a lookalike. They got it back, but only after negotiating.
- Ledger Academy says a trader lost $2.6 million ($843,000 plus $1.75 million) to zero-value transfer spoofing on May 26, 2025.
Chainalysis’s figures make it clear the scammers are playing the odds. The operation behind that May 2024 theft lasted 66 days, from February 28 to May 4, 2024, and planted 82,031 lookalike addresses, and 2,774 victim addresses ended up sending it a combined $69,720,993.
Don’t assume a small wallet is safe. Chainalysis puts the median campaign profit in 2024 at about $400, and while the victims in that campaign averaged $338,900, their median balance was about $1,000.
How Wallets and Explorers Deal With Address Poisoning
According to Trezor, the targets are Ethereum and EVM chains like BNB Smart Chain, Polygon and Avalanche, since cheap fees let scammers blast out transactions in bulk. Trezor also says any blockchain could technically see it.
Every wallet maker and block explorer has come up with its own answer.
| App or site | How it fights poisoning | Your part |
|---|---|---|
| MetaMask, on Mobile and the Extension | It blocks you with a warning if a pasted address shares the first four and last four characters with someone you’ve paid, and it warns you about first-time recipients | Keep trusted addresses in Contacts |
| Trezor Suite | Suspicious transactions get blurred and marked unverified | Read the address on the device’s screen |
| Ledger Live | Zero-value token transfers are hidden out of the box | Go over the full address on the Ledger’s screen |
| Etherscan | It hides zero-value transfers and low-reputation tokens by default and flags spoofed tokens and addresses | Lean on Private Name Tags and the ignore lists |
MetaMask
On June 17, 2026, MetaMask switched on Address Poisoning Detection in MetaMask Mobile and the browser extension. It checks whatever address you paste against the ones you’ve dealt with before, and when the four characters at each end match while the middle doesn’t, a blocking warning pops up before anything is sent.
Every EVM network is covered, and MetaMask lists more as coming soon. You’ll also get a warning when paying an address you’ve never touched.
We’d call that overdue, frankly. For everything else about the app, see our MetaMask vs Trust Wallet comparison.
Trezor Suite
Trezor Suite screens out transactions that look off. If it decides one is only there to poison your history, it blurs that entry and tags it as unverified. A setting to hide them completely isn’t finished yet, Trezor says.
You also get the device’s own screen, where you can check where the money’s going before you sign, and our Trezor Safe 5 review spends some time on that display.
Ledger
Out of the box, Ledger Live keeps zero-value token transfers hidden, which means those poisoned lines don’t show up in your history at all. Ledger’s advice is to check addresses on the device’s trusted screen. Its Clear Signing initiative is meant to put every detail of a transaction on that screen.
Of course, that screen is useless if you skim it. Our Ledger Nano X review shows how the device lays out an address.
Etherscan
By default Etherscan keeps zero-value transfers out of view, though a toggle brings them back. It does the same for transfers of low-reputation tokens, flags spoofed tokens and addresses, and prints more of each address so a lookalike stands out. Copy an address off a suspicious token and you’ll get a popup reminder first.
Keeping Address Poisoning Out of Your Wallet
- Don’t ever take a destination address from your transaction history or from a block explorer. MetaMask and Trezor both tell you the same.
- Put the addresses you pay regularly into your wallet’s address book. MetaMask keeps it under “Contacts” in the menu.
- Read every character, and pay the most attention to the middle, since a matching start and end tells you nothing.
- Before a big transfer, send a small test amount and make sure it arrived, which is what Trezor and Chainalysis both suggest.
- Confirm the destination on a hardware wallet’s screen. If you’re shopping, start with our best hardware wallets for MetaMask.
- Leave surprise zero-value or dust transactions alone, along with tokens you never bought.
- Update your wallet app, or you’ll miss new warnings like MetaMask’s detection feature.
Holding a lot? A multisig wallet means a second person or device has to approve a transfer, and that’s one more chance for somebody to notice the address is wrong.
Slip-Ups That Let Address Poisoning Work
- People check the first four and last four characters and stop. Those are precisely the characters a scammer copies, so keep reading into the middle.
- It’s tempting to grab the newest line in your history. Go to your saved contacts instead.
- A transaction you never made, worth 0, feels harmless. It’s sitting there waiting for you to copy it.
- Some people drop the test transfer on a large payment to dodge one fee, which we think is a bad trade given what a lost transfer costs.
- A modest balance won’t keep scammers away. In the campaign Chainalysis looked at, the median victim held about $1,000.
- Pressing approve on a hardware wallet without reading the address wastes the whole point of having one.
None of these checks are special to poisoning. Our walkthrough of how to send Bitcoin to another wallet goes through each of them in order.
Address Poisoning Questions People Ask
Can an address poisoning scam take my crypto without me approving anything?
No. Your keys never leave your hands, so you only lose money if you copy the lookalike and send it a transaction yourself.
Should I worry about a zero-value transfer showing up in my history?
On its own, it can’t hurt you. It’s bait that the scammer hopes you’ll copy down the line, so leave it alone and don’t copy any address out of it.
If I’ve already paid a poisoned address, can I recover the money?
Probably not. Nobody can reverse a blockchain transaction, so unless the person on the other end sends it back, it’s gone. The WBTC victim from May 2024 did get their funds returned, though only through negotiation with the attacker.
Which chains does address poisoning hit?
Mainly Ethereum and EVM chains such as BNB Smart Chain, Polygon and Avalanche, Trezor says, because the fees there are cheap. In theory, it could happen on any chain.
Will a hardware wallet protect me from address poisoning?
Partly. You still have to read the whole destination address on its screen before approving.
Has MetaMask done anything about address poisoning?
Yes. From June 17, 2026, MetaMask Mobile and the Extension throw up a blocking warning on EVM networks whenever a pasted address shares its first four and last four characters with a previous recipient.
The Short Version on Address Poisoning
The whole scam leans on one lazy habit, which is copying an address out of your history and only checking its ends. Researchers logged 270 million attempts across two years, and a single slip in May 2024 handed $68 million to a scammer. MetaMask, Trezor Suite and Ledger Live all filter or flag poisoned entries now, yet none of them does the job of reading the full address for you.
Keep a list of trusted addresses, test big transfers with a small one first, and check the destination on a hardware wallet’s screen. Get the address wrong and that money won’t come back.
This article is for general information only and is not financial, legal, or investment advice. Prices and features change; check the vendor’s official page before buying.
