Address Poisoning: Why the Address You Copied Was Wrong (2026)

Published: September 2026 · By the bsvar editorial team

Short answer: address poisoning works by planting a lookalike address in your own transaction history. The attacker sends you a worthless transaction from an address whose first and last few characters match one you really use. Later you copy an address from your history, glance at the ends, see a match, and send your funds to the attacker.

Nothing is hacked. Your wallet is not compromised. The attack targets a habit — checking only the beginning and end of an address.

The four steps of address poisoning: watch the chain, generate a lookalike, send dust, wait for you to copy from history

How the attack is built

Crypto addresses are long and unreadable, so every wallet shows them truncated: 0x7a3f...9c21. Everyone learned to verify by comparing those visible ends.

Attackers automated the generation of addresses matching arbitrary prefixes and suffixes. Producing an address that starts 0x7a3f and ends 9c21 is computationally cheap. Producing one that matches the entire address is not possible — which is exactly why the attack relies on you never looking at the middle.

The delivery step is what makes it work:

The attacker watches public blockchain activity and sees you send funds to a particular address.
They generate a lookalike of that address.
They send you a zero-value or dust transaction from the lookalike — often a tiny amount of a fake token, sometimes literally zero.
That transaction now sits in your history, adjacent to your real transfers.
Next time you send to that counterparty, you scroll your history, copy "the address I used before", and check the ends. They match.

Some variants go further, sending the dust transfer immediately after your real one so the two appear side by side, with the fake one on top.

Why it catches careful people

This attack does not depend on carelessness in the usual sense. It defeats a verification routine that most guides actively recommend — checking the first and last characters. The people most at risk are those who transact often enough that copying from history feels natural and safe.

It is also patient. The dust transaction can sit there for months before you act on it.

Defending against it

1. Never copy an address from your transaction history. This is the single rule that defeats the attack completely. History is attacker-writable — anyone can put an entry there. Always copy from the source: the recipient's current deposit page, or your own wallet's receive screen.

2. Use an address book or whitelist. Save verified addresses under clear labels and send only from those saved entries. On an exchange, enable the withdrawal whitelist so non-approved addresses are blocked outright. See Withdrawal Address Whitelist: The Setting That Stops the Costliest Mistake.

3. Verify the middle, not just the ends. If you must check manually, compare a run of characters from the centre of the address. That is the part attackers cannot match.

4. Send a test transaction on any new or large transfer. A small amount first confirms the route before the rest follows.

5. Ignore unexpected tokens and dust. Do not interact with them, do not try to sell them, and do not visit any website named in the token. Some fake tokens are designed so that interacting triggers a malicious approval.

6. Hide, do not engage. Most wallets let you hide spam tokens. Hiding is safe; interacting is not.

What to do if you receive dust

Nothing. That is the correct answer.

Receiving a dust or zero-value transaction is harmless in itself. It does not give the sender any access to your wallet, and it cannot move your funds. It is an advertisement placed in your history, not a breach.

Specifically, do not:

Try to send it back — you would be paying a fee to interact with an attacker's address.
Swap or sell the token.
Visit a URL embedded in the token name.
Connect your wallet to any site that claims it can clean your history.

Do:

Hide the token in your wallet interface.
Treat every address in your history as untrusted from that point on.

If you already sent to a poisoned address

Act on facts, then accept the constraints:

Get the TXID and confirm on a block explorer where the funds went. See How to Use a Block Explorer to Check Any Transaction.
If the destination is an exchange, report it to that exchange with the TXID — occasionally funds can be frozen if reported quickly, though this is not common.
If the destination is a private address, the funds are not recoverable. No service can reverse a confirmed transaction.
Report it to the relevant authority in your jurisdiction if you choose to.
Refuse all recovery offers. Anyone contacting you about the loss is running the follow-on scam. The first loss makes you a target for the second.

Then change the habit that allowed it, before the next transfer.

FAQ

Can they steal from me just by sending dust?

No. Receiving a transaction gives the sender no control over your wallet. The danger is entirely in what you do next.

Is my wallet compromised?

No. Your keys are unaffected. The attacker only wrote a public entry into a public ledger.

Why did they pick me?

Usually not personally. Blockchains are public, and this is automated at scale against any address with visible activity.

Does a hardware wallet prevent it?

Partially. A hardware wallet shows the full address on its screen for confirmation, which gives you a real chance to catch it — but only if you actually read it rather than pressing confirm.

Can I delete the dust from my history?

No. Blockchain history is permanent. You can hide it in your wallet's interface, which is enough.

Do exchanges protect against this?

The withdrawal whitelist does, effectively. It is the strongest practical protection available to an exchange user.

Educational content, not financial advice. Attack techniques evolve; treat this as a description of a pattern rather than an exhaustive list. See our Advertising & Commission Disclosure.