Last updated: October 15, 2026
Address poisoning is a crypto scam where an attacker sends you a tiny or zero-value transaction from an address that looks almost identical to one you use — same first and last characters — hoping you'll later copy it from your history and send real funds to them. It is common on USDT (Tron and Ethereum) and costs victims millions. The fix is simple: never copy an address from your transaction history, and check the full address before every send, including the deposit address of a crypto swap.
- 4–6 characters typically matched
- $0 cost to the attacker per fake tx
- Irreversible once sent
- 1 habit that stops it
How address poisoning works
- You send USDT to a real address, e.g.
TQ7x…9kLm. - A bot watching the chain generates a lookalike address starting and ending with the same characters:
TQ7x…9kLm— the middle is different. - It sends you a zero-value or dust transfer (or a fake token) from that lookalike, so it appears in your wallet history.
- Next time, you copy "the usual address" from history — and pick the attacker's.
Wallets shorten addresses to the first and last few characters, which is exactly what the attacker copies. Crypto transactions are irreversible, so funds sent to the lookalike are gone.
Related address scams at a glance
| Scam | How it works | Defense |
|---|---|---|
| Address poisoning | Lookalike address planted in your history | Never copy from history; use an address book |
| Clipboard malware ("clipper") | Malware replaces a copied address with the attacker's | Check the full address after pasting; keep devices clean |
| Fake deposit page | Phishing copy of an exchange shows the attacker's deposit address | Use bookmarked official URLs and verified listings |
| Fake support | "Support" asks you to resend to a "new" address | Only trust the address on your own order page |
How to protect yourself (step by step)
- Never copy addresses from your transaction history. Copy from the source: your receiving wallet, your contact's message, or the swap order page.
- Check the whole address, not only the start and end. Compare a few characters in the middle too.
- Use your wallet's address book for addresses you send to repeatedly.
- Scan a QR code instead of copy-pasting when you can.
- Confirm on a hardware wallet screen — malware can't change what the device shows.
- Send a small test first for large amounts — see swapping large amounts.
- Hide zero-value and spam tokens in your wallet settings so fake entries don't clutter your history.
Address safety when swapping crypto
An instant swap involves two addresses: the deposit address the exchange gives you and your own receiving address. Copy the deposit address only from the order page on the official site, and paste your receiving address straight from your wallet. Use a fresh receiving address each time — on Monero that's easy with subaddresses. Also set a refund address you control. Choose services listed with a public track record and check legit reviews to avoid phishing clones.
Frequently asked questions
What is address poisoning in crypto?
A scam where an attacker sends you a tiny transaction from an address that looks like one you use, hoping you'll copy it from your history and send funds to them.
Can poisoned transactions steal my funds directly?
No. Receiving a dust or zero-value transaction doesn't give anyone access to your wallet. The danger is only that you copy the fake address later.
Can I get funds back if I sent to a poisoned address?
Usually not — crypto transfers are irreversible. If it was USDT you can report it to Tether and law enforcement quickly; frozen funds are sometimes returned. See can Tether freeze USDT.
Does address poisoning happen with Monero?
It is much harder: Monero hides transaction history from outsiders, so attackers can't see which addresses you pay. Clipboard malware is still a risk, so check pasted addresses.
Which coins are most targeted?
USDT on Tron and Ethereum, plus ETH and other EVM tokens, because history is public and addresses are easy to imitate.
Swap safely with addresses from your own wallet: USDT → XMR, USDT → BTC or all no-KYC pairs. No account, no ID, no logs.