Cookie Settings

We use cookies to improve your experience. Essential and analytics cookies are automatically enabled. View cookie preferences

    Skip to main content
    Practical guide

    Address poisoning: how to check before you send

    Address poisoning does not hack your wallet. The attacker creates an address whose first and last characters match one you use, then sends a zero-value or tiny transfer so it appears in your transaction history. The next time you copy an address from that history, you may copy his. The transfer you then sign is valid and cannot be reversed.

    Check an address free

    Six habits that stop it

    01

    Never copy from transaction history

    Take the recipient address from its original source: the exchange deposit page, the invoice, or the person directly. Your history can contain entries you never made.

    02

    Save trusted addresses once

    Use your wallet's address book or the exchange's withdrawal whitelist for addresses you pay regularly, after checking them once in full.

    03

    Compare the middle, not just the ends

    Wallets often shorten addresses to the first and last few characters, which is exactly the part the attacker copies. Read the full address, including the middle.

    04

    Treat unexpected zero-value transfers as a warning

    A 0 USDT transfer, or a token transfer you did not initiate, from an address that looks like one of yours is the typical sign that your history has been seeded.

    05

    Send a small test first for large amounts

    For a large payment, send a small amount and ask the recipient to confirm it arrived before sending the rest.

    06

    Check the address on the explorer before signing

    Paste the destination into the explorer. If it is a brand-new address whose only history is tiny or zero-value transfers to you, stop: that is the profile of a poisoning address, not of the person you meant to pay.

    What not to do

    • Do not interact with the poisoned entry or tokens it sent you: no 'claim', no approval, no visiting links in token names.
    • Do not trust an address because it appears in your history or shows the right first and last characters.
    • Do not pay anyone offering to recover funds sent to a poisoned address. Report it through official channels instead.
    • Do not accept a 'new' or 'updated' address sent in chat without confirming it through a second channel you already trust.
    • Do not hide spam tokens and forget them: hiding is fine, but remember the poisoned entries stay in the explorer history.

    Already happened? First steps

    1. Send nothing more and sign nothing new.
    2. Save the transaction hash, the addresses and chat screenshots.
    3. Report it today through official channels; never pay 'recovery' services.
    Where to report crypto theft

    Questions people ask

    Can address poisoning steal funds without my signature?

    No. It only works if you send funds to the look-alike address yourself. The zero-value entry in your history cannot move your money on its own.

    I received a 0 USDT transfer from an address like mine. What now?

    Your wallet is not compromised. Ignore the entry, do not copy addresses from history, and save the addresses you really use in your address book.

    Can I get back crypto sent to a poisoned address?

    Blockchain transfers cannot be reversed by the sender. If the funds reach an exchange or a freezable stablecoin, a fast official report can help, so report it immediately.

    I just sent funds to a poisoned address. What do I do first?

    Stop further payments, save the transaction hash, the wrong address and screenshots, then report it the same day: to your exchange's support if the funds left an exchange, and through the official channels in our report guide. Never pay a 'recovery' service.

    Does address poisoning only happen on Ethereum?

    No. It works on any chain where anyone can send you a transfer that shows up in your history, including Tron and other EVM networks. The habits above apply on all of them.

    Why do the first and last characters match so well?

    Attackers generate huge numbers of addresses with software until one matches the start and end of yours. That is cheap to do, so a matching start and end proves nothing.

    Does a hardware wallet protect me?

    Only if you read the full address on the device screen before confirming. The device signs whatever address you pasted, including a poisoned one.

    Should I send a transaction to 'cancel' the mistake?

    No. A confirmed transfer cannot be cancelled, and anyone offering a 'reversal' transaction or tool is running a second scam.

    Keep reading

    Educational information only — not financial or legal advice.