Address poisoning: lookalike addresses that fool even experts

Address poisoning is a scam in which the criminal creates a wallet address whose first and last characters match an address the victim uses, sends a negligible transaction to “plant” it in the victim's history, and waits for the victim to copy it from there on their next transfer. Nothing is hacked and no password is stolen: the scam exploits haste and the habit of checking only the ends of an address. And, as with every blockchain payment, the mistake cannot be undone.

How the scam works

The sequence is almost always the same, and MetaMask describes it in its own help center:

1. The criminal watches the blockchain for transfers, usually of stablecoins, to and from addresses of interest.
2. They generate a “vanity” address whose first and last characters match the legitimate address the victim usually uses.
3. From that fake address, they send a zero-value or negligible transaction to the victim's wallet. The lookalike now shows up in the history.
4. The next time the victim makes a transfer, they copy the address from the history, and pick the wrong one.

Step 4 is helped by the interfaces themselves. Wallets and block explorers often shorten addresses with an ellipsis, showing only the beginning and the end. That is exactly the part the criminal faked.

The size of the problem

The most comprehensive study published so far comes from Carnegie Mellon University researchers and was presented at the 2025 USENIX Security Symposium. Analyzing two years of Ethereum and BNB Smart Chain data, the authors counted 270 million poisoning attempts aimed at 17 million victims, thirteen times more than previously reported. Of those attempts, 6,633 led to losses totaling at least US$83.8 million.

The paper also suggests this is an organized activity: the researchers identified a few large groups competing with each other, and at least one appears to use graphics cards (GPUs) to generate lookalike addresses at scale. In other words, producing a convincing fake address has become cheap.

Documented cases

The numbers become concrete in two widely reported cases.

May 2024. A victim sent 1,155 WBTC, worth about US$68 million at the time, to a poisoned address. The case had a rare ending: after negotiations, the attacker returned about 22,960 ETH, roughly US$65.7 million, according to Cointelegraph. It was the scammer's own decision, not something the network or any institution could enforce.

December 2025. According to The Block, an investor did what is usually recommended: first sent a 50 USDT test transaction to the correct address. About 26 minutes later, they transferred 49,999,950 USDT, but to a fake address sharing the first five and last four characters of the real one, planted in their history through small transactions. Within 30 minutes, the scammer had already swapped the funds, which later ended up in a crypto mixing service.

Why even experienced users fall for it

The second case shows the core issue. A test transaction confirms that the address at that moment is right, but it does not protect the next copy. If the address for the main transfer is copied again, from the history, the test becomes false reassurance. Three factors add up: interfaces that hide the middle of the address, the habit of using the history as a contact list, and the speed of bots that react to a transfer within minutes.

Lookalike addresses also appear outside the history. In the September 2025 attack on programming libraries described by Aikido Security, the malicious code replaced addresses shown on websites with others chosen to resemble the originals. The technique is the same; only the place where the fake address is inserted changes.

How to protect yourself

For anyone sending crypto (and for businesses that make payouts, refunds or withdrawals):

• Never copy addresses from your transaction history. Use a book of verified addresses or a list of approved destinations.
• Compare the whole address, paying attention to the middle, not just the start and the end.
• Check again for the main transfer, not only for the test.
• On hardware wallets, confirm the address on the device screen before signing.
• Take wallet warnings seriously about addresses that resemble ones you have used or that you have never used before.

For merchants receiving crypto payments:

• Always deliver the payment address through the payment page, generated for that request, and never ask customers to look it up in an explorer or their history.
• For refunds, confirm the destination address through a verified channel, ideally the customer's own account details.
• Make sure the address shown on your page is the one you issued, since lookalike addresses can be inserted there too.

Where Proteside fits

Poisoning happens in the wallet history, outside the store; there, the defense is the habit of checking. On your payment page, Proteside checks in the buyer's browser that the address, network and amount displayed or copied are exactly what you issued, and blocks any swap before funds are sent. See crypto payment protection and try it free for 14 days.