HostDeFi › Guides › Address poisoning
Address poisoning: the attack that waits for one careless copy-paste
It doesn't hack your wallet and doesn't need your signature. It just plants a lookalike address in your history and waits for you to copy it.
Address poisoning is the most patient attack in crypto. The attacker studies addresses you actually transact with, generates a vanity address whose first and last characters match, and then puts it into your transaction history — via a zero-value transfer, a dust deposit, or a spoofed token event. Then they wait. The day you prepare a real transfer by copying "your usual address" from history — because the ends look right and that's all anyone checks — the money goes to them. Irreversibly.
Why it works so well
Because the attack targets a habit, not a vulnerability. Crypto interfaces display addresses truncated ("Ax7b…9Qf2"), training everyone to verify exactly the characters the attacker can match. Generating a vanity address matching several leading and trailing characters is computationally cheap; matching the middle is not — which is precisely why the middle is where the truth lives. The scale is industrial: security firm Blockaid reported flagging tens of millions of poisoning transactions on-chain since early 2025, with monthly attempt volume spiking above three million by January 2026, and independent researchers have tallied hundreds of millions of attempts across major chains with tens of millions of dollars in confirmed losses. Attempt-to-success ratios are tiny — and the attack is cheap enough that tiny is profitable.
The variants worth knowing
Zero-value dusting: a transfer of nothing (or a few cents) from the lookalike, existing purely to enter your history. Fake token events: spoofed transfer records that make the lookalike appear as a counterparty you've dealt with. Paste hijacking: the aggressive cousin — clipboard malware that swaps the address after you copy a legitimate one, defeating even a careful history. Different plumbing, same ending: money sent to an address that looked right.
The defense in one habit: never source a destination address from your transaction history. History is attacker-writable. Use an address book you populated deliberately, and verify a middle segment of the address — not just the ends — before signing anything large.
The full defensive stack
Maintain your wallet's saved-contacts list and send only to entries you created. For any meaningful transfer, send a test amount first and confirm receipt out-of-band before the balance follows — the cost of a second transaction is the cheapest insurance in crypto. Verify eight or ten characters from the middle of the address, where vanity generation can't reach. Ignore dust and unknown tokens that appear in your wallet — interacting with them is a separate trap covered in fake airdrop claim sites. And if you sign on a hardware wallet, read the address on the device screen, which clipboard malware can't rewrite. If a poisoned transfer does go out, the response playbook in wallet drained — what to do applies from minute one.
Dusted by a strange token? Read it before touching it
Paste the token's address — the scan reads what it is on-chain, with no claim site visited.
Frequently asked
What is an address poisoning attack?
An attacker generates a lookalike of an address you transact with — matching its first and last characters — and plants it in your transaction history via dust or zero-value transfers. When you later copy 'your usual address' from history, the funds go to the attacker instead.
How common is address poisoning?
Industrial-scale: security firm Blockaid reported flagging tens of millions of poisoning transactions since early 2025, with attempts spiking past three million per month by January 2026, and researchers have tallied hundreds of millions of attempts across major chains. Success rates are tiny, but the attack costs almost nothing to run.
Can address poisoning steal funds without me doing anything?
No — the dust transfer itself takes nothing and needs no signature. The theft only happens if you later copy the lookalike address and send to it. That's the defense too: never source destinations from history, and the attack never completes.
How do I check an address is really mine?
Compare a segment from the middle, not the ends — vanity generation makes matching ends cheap and middles computationally infeasible. Better: use a deliberately maintained address book, send a test amount first on large transfers, and confirm on a hardware wallet's own screen when you have one.