<p>Address poisoning is an on-chain social-engineering attack. An attacker generates a fake wallet address that closely resembles one you have transacted with, then inserts it into your history using a zero-value transfer. The next time you send crypto, you may copy the poisoned address from your transaction list instead of the real one and send funds straight to the attacker.</p>



<p>The scale is larger than most people assume. <a href="https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf">Researchers at USENIX Security 2026</a> tracked 270 million attack attempts against 17 million victims, and confirmed at least $83.8 million in losses across 6,633 incidents. That makes it one of the largest phishing operations ever documented on-chain.</p>



<p>Nothing about your wallet is compromised. Your seed phrase stays safe, your keys are untouched, and no contract is exploited. The attack works entirely by exploiting the habit of copying addresses from transaction history. One mistaken paste can move a seven-figure balance.</p>



<p>NFT holders face a variant of the same tactic. Anyone can mint and send an NFT to any address without consent, so scammers airdrop junk collectibles into the wallets of well-known collectors. Followers who browse those public wallets see the token and assume the collector bought it deliberately. This is distinct from NFT spoofing, which copies the artwork rather than the wallet history.</p>



<p>The name borrows from DNS poisoning, a different and more dangerous attack that hijacks domain resolution. In that case you type &quot;metamask.io&quot; and land on a convincing replica built to harvest your <a href="https://www.thecoinzone.com/security/crypto-seed-phrases">seed phrase</a>. Address poisoning does not touch your browser or your connection. It only manipulates what appears in your transaction list.</p>



<p>That limitation is also the good news. Once you know the mechanism, it is straightforward to avoid.</p>



<h2 class="wp-block-heading tablecontent">How Much Can You Lose? Real Numbers</h2>



<p>Address poisoning is not a theoretical risk. Here is what the data shows.</p>





<p style="margin:0 0 16px 0;font-size:16px">
👉 <strong>Quick takeaway:</strong> The success rate is tiny. Roughly 6,600 confirmed losses out of 270 million attempts means the vast majority of poisoning attacks fail. But attempts cost the attacker almost nothing, and the average successful hit clears $12,000. That asymmetry is why the tactic persists at this scale.
</p>
<div style="overflow-x:auto;margin:0 0 24px 0">
  <table style="width:100%;border-collapse:collapse;font-size:16px;line-height:1.5;min-width:500px;border:1px solid #e5e7eb"><thead><tr style="background-color:#f8fafc;text-align:left"><th style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Metric</th><th style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Figure</th></tr></thead><tbody><tr><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb"><strong>Total on-chain attack attempts</strong></td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#dc2626;font-weight:600">🔴 270 million</span>
        </td></tr><tr style="background-color:#fcfcfd"><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb"><strong>Victims identified</strong></td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#dc2626;font-weight:600">🔴 17 million</span>
        </td></tr><tr><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb"><strong>Confirmed incidents with losses</strong></td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#d97706;font-weight:600">⚠️ 6,633</span>
        </td></tr><tr style="background-color:#fcfcfd"><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb"><strong>Total confirmed losses</strong></td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#dc2626;font-weight:600">🔴 $83.8 million</span>
        </td></tr><tr><td style="padding:14px 16px"><strong>Average loss per confirmed incident</strong></td><td style="padding:14px 16px">
          <span style="color:#dc2626;font-weight:600">🔴 ~$12,630</span><br/>
          <span style="color:#dc2626;font-weight:600">🔴 One mistaken paste</span>
        </td></tr></tbody></table>
</div>




<p>The average confirmed loss is roughly $12,630 per incident. That figure covers only cases researchers could verify on-chain. Actual losses are almost certainly higher. MetaMask&#x27;s Blockaid tool, which monitors transactions in real time, has flagged tens of millions of targeted interactions inside MetaMask alone.</p>



<h2 class="wp-block-heading tablecontent">How Address Poisoning Works in Crypto </h2>



<p>Address poisoning works for many reasons:</p>



<ul class="wp-block-list">
<li>Blockchain transactions aren’t reversible</li>



<li>Free online tools can generate similar addresses within seconds</li>



<li>Most users aren’t going to double-check every transaction</li>



<li>In some blockchains, it’s almost free to send zero tokens to any wallet</li>



<li>Wallet apps shorten the addresses to improve user experience</li>
</ul>



<p>Some apps only allow sending across wallets that you previously whitelisted. But not in Metamask, and there might be hundreds of wallets with the same prefix and suffix.</p>



<p>(If wallets were websites, “myrealaddress.com” and “myfakeaddress.com” would be shortened to “my…address.com.”)</p>



<p>Whenever you send crypto:</p>



<ol class="wp-block-list">
<li>Anyone can see the sender and receiver on the blockchain’s website.</li>



<li>An attacker uses a<strong> vanity address generator</strong> and opens a wallet that matches your shortened address. Either the sender or recipient&#x27;s address.</li>



<li>The attacker adds funds to this wallet for network fees. Then, they make a<strong> zero-token transaction</strong> to your address.</li>



<li>While you don’t receive any tokens, the completed transaction will appear in your history. And the shortened sender looks identical to your previous (real) transaction.</li>
</ol>



<p>That’s the setup. The next time you send crypto to the same address, scammers expect you to copy it from the history and paste it without second thoughts. <strong>Address poisoning is inexpensive</strong>, so they can repeat it with hundreds of users until eventually, someone falls for it.</p>



<p>Tiny incoming transactions are common on most blockchains. Protocols use them for airdrops, governance participation, and smart contract interactions. Attackers exploit this familiarity. A zero-value or near-zero transfer from an address that looks like one you recognize blends in completely. Most users scroll past it. That is the entire mechanism.</p>



<h3 class="wp-block-heading">Which Protection Method Should You Use?</h3>



<p>Not every method fits every situation. Use this framework to pick the right one.</p>





<p style="margin:0 0 16px 0;font-size:16px">
👉 <strong>Quick takeaway:</strong> The last row is the one that matters most. Address poisoning only works because people copy addresses from their transaction history. Break that habit and every other defense becomes a backup rather than a necessity. Whitelisting and test transactions handle the cases where you cannot avoid pasting something new.
</p>
<div style="overflow-x:auto;margin:0 0 24px 0">
  <table style="width:100%;border-collapse:collapse;font-size:16px;line-height:1.5;min-width:750px;border:1px solid #e5e7eb"><thead><tr style="background-color:#f8fafc;text-align:left"><th style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Situation</th><th style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Best Method</th><th style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Why</th></tr></thead><tbody><tr><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Sending to the same address repeatedly</td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#15803d;font-weight:600">🟢 Whitelist it</span>
        </td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          One-time setup, immune to poisoning afterward<br/>
          <span style="color:#15803d;font-weight:600">🏆 Least ongoing effort</span>
        </td></tr><tr style="background-color:#fcfcfd"><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Sending to a new address for the first time</td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#15803d;font-weight:600">🟢 Test transaction first</span>
        </td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Confirms the address before committing large funds</td></tr><tr><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">High-value transfer, unfamiliar address</td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#15803d;font-weight:600">🟢 Whitelist plus test transaction</span>
        </td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          Double layer; worth the extra 60 seconds<br/>
          <span style="color:#15803d;font-weight:600">🏆 Strongest protection for large sums</span>
        </td></tr><tr style="background-color:#fcfcfd"><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Using MetaMask on Ethereum</td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">
          <span style="color:#15803d;font-weight:600">🟢 Enable ENS and Blockaid</span>
        </td><td style="padding:14px 16px;border-bottom:1px solid #e5e7eb">Human-readable names remove the character-matching problem</td></tr><tr><td style="padding:14px 16px">Any wallet, any chain</td><td style="padding:14px 16px">
          <span style="color:#dc2626;font-weight:600">🔴 Never copy from transaction history</span>
        </td><td style="padding:14px 16px">
          Copy only from the original source: email, website, or QR code<br/>
          <span style="color:#dc2626;font-weight:600">🔴 The single rule that prevents the attack</span>
        </td></tr></tbody></table>
</div>




<p>The single highest-leverage habit is never copying an address from your transaction history. Attackers cannot poison an address you never look up in history.</p>



<h2 class="wp-block-heading tablecontent">How To Avoid Address Poisoning</h2>



<p>The simplest and most tedious way to avoid poisoning is to type every character every time. But if you don’t remember what the address should be, it’s not any better than copy-pasting.</p>



<p>Here are other ways:</p>



<h5 class="wp-block-heading">Whitelist the address</h5>



<p>Almost every exchange and wallet app has a whitelist. Some will by default restrict payments only to those addresses, but it can be changed from settings. It’s a manual process that attackers can’t manipulate.</p>



<p>(if your wallet ever got hacked, hackers would still need device/2FA verification to change the whitelist)</p>



<p>Another benefit is having fewer verification steps when sending to those wallets. </p>



<h5 class="wp-block-heading">Verify against your original transaction.</h5>



<p>Attackers cannot spoof the very first transaction you ever made to a given address. They do not know which address is real until you use it publicly. So the first confirmed transaction in your history is the safe reference point. If you see two entries that look identical in your shortened view, paste both into a text comparison tool and look for the difference. The real one is the older one.</p>



<h5 class="wp-block-heading">Only Copy from big transactions</h5>



<p>Why would scammers ever send hundreds of dollars to strangers? Expect no more than a few cents. If the transaction is at least $5, the address is probably real.</p>



<h5 class="wp-block-heading">Test transactions</h5>



<p>Send a small test transaction before any large transfer. If you send $5 first and it reaches the right wallet, you have confirmed the address before committing $1,000 or more. The math is straightforward: a $5 test on a $5,000 transfer risks 0.1% to protect 99.9%. This does not prevent attackers from collecting the $5 if the address is poisoned, but it stops a much larger loss. Skip this step only when network fees make it economically impractical.</p>



<h2 class="wp-block-heading tablecontent">Protecting Metamask From Address Poisoning</h2>



<p>MetaMask is the most widely used Web3 wallet, which also makes it the most targeted. Here is what its current toolset looks like.</p>



<ul class="wp-block-list">
<li><strong>Address Book (Whitelist).</strong> Go to Settings &gt; Contacts to add trusted addresses. Once saved, you can send to them by name instead of pasting a raw address string.</li>



<li><strong>Blockaid real-time detection.</strong> MetaMask now integrates Blockaid, a security layer that flags suspicious transactions before you confirm them. The MetaMask June 2026 Security Report documents that Blockaid has detected tens of millions of address-poisoning-related interactions. It does not require any setup. It runs automatically inside the MetaMask extension and mobile app.</li>



<li><strong>Ethereum Name Service (ENS).</strong> Register a human-readable name like yourname.eth. Sending to a name instead of a raw address makes lookalike attacks obvious at a glance.</li>



<li><strong>Hardware wallet pairing.</strong> Connecting MetaMask to a Ledger or Trezor adds a physical confirmation step. You see the full destination address on the hardware device screen before signing. That extra second of visibility catches most poisoning attempts.</li>
</ul>



<p><em>Note: The claim that address poisoning is less common on non-Ethereum EVM chains is not supported by current research and has been removed pending verification.</em></p>



<h2 class="wp-block-heading tablecontent">What Researchers and Wallets Are Building to Stop This</h2>



<p>The scale of address poisoning has pushed both academic researchers and wallet teams to build systematic defenses.</p>



<ul class="wp-block-list">
<li><strong>Toxin Tagger.</strong> Carnegie Mellon University&#x27;s CyLab and collaborators at USENIX Security 2026 released Toxin Tagger, a live monitoring system that tracks address-poisoning attempts on-chain in real time. It identified the 270 million attempts and 17 million victims cited throughout this article. The public monitoring framework is intended to give researchers and security teams early warning of new poisoning campaigns.</li>



<li><strong>ERC-8117.</strong> An Ethereum Improvement Proposal (EIP-8117) proposes an anti-poisoning compact address format at the protocol level. If adopted, it would make it structurally harder to generate lookalike addresses that pass visual inspection. The proposal is under active community discussion.</li>



<li><strong>Wallet-embedded screening.</strong> Beyond MetaMask, Trust Wallet and Bitpanda Custody have both updated their user guidance to include address-poisoning warnings. The direction across the industry is toward flagging suspicious incoming zero-value transactions directly in the UI rather than relying on users to notice them.</li>
</ul>

North Korean Developers Inside a Fake DeFi Startup: What Researchers Found

Gnosis Safe Security Checklist: Protect Your Multisig Wallet

How to Store Crypto Safely: Wallets, Seed Phrases, and Threats

What Is a Scam Wick in Crypto?

Address Poisoning: How the Scam Works and How to Avoid It

Attackers plant lookalike addresses in your transaction history so you paste the wrong one. Learn how address poisoning works and the one habit that prevents it.