> ## Content Index > Fetch the complete content index at: https://stablecoininsider.org/llms.txt > Use this file to discover other available public pages before exploring further. # What Is Address Poisoning? How to Spot Lookalike Scams - URL: https://stablecoininsider.org/what-is-address-poisoning/ - Published: 2026-11-11T10:36:42.000Z - Updated: 2026-11-11T10:39:18.000Z - Description: Address poisoning plants a lookalike address in your wallet history with zero-value, dust or fake-token transfers. How the attack works, why USDT and USDC dust jumped 612% after Fusaka, the $50M and $12.2M thefts, and seven checks that stop it, read 11 November 2026. - Author: Milos Djukanovic - Tags: Fundamentals, stablecoin security, Stablecoin Scams, USDT, USDC, Ethereum Address poisoning is a scam in which an attacker plants a lookalike wallet address in your transaction history, usually with a zero-value or dust stablecoin transfer, and waits for you to copy it. The fake matches the first and last characters of an address you use, so your next payment goes to the attacker, irreversibly. The scale is industrial. A Carnegie Mellon study presented at USENIX Security 2025 counted about 270 million poisoning attempts against 17 million victims on Ethereum and BNB Smart Chain between July 2022 and June 2024, with at least $83.8 million stolen ([Tsuchiya et al., USENIX Security 2025](https://www.usenix.org/conference/usenixsecurity25/presentation/tsuchiya)). After Ethereum's Fusaka upgrade cut fees on 3 December 2025, USDT dust transfers on Ethereum rose 612% in 90 days, according to [Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/). This guide covers how an attack works, the three transfer types attackers use, why stablecoins are the bait, how much has been lost, and the checks that stop it. *Last updated: 11 November 2026\. Figures and wallet features re-checked against the research paper, Etherscan, Coin Metrics and wallet help pages on this date.* ## Key Takeaways - Address poisoning does not steal keys or exploit code; it relies on you copying a lookalike address from your own transaction history. - Researchers found about 270 million poisoning attempts against 17 million victims on Ethereum and BSC from July 2022 to June 2024, with at least $83.8 million lost. - Zero-value transfers (147.7 million) and counterfeit-token transfers (118.4 million) make up almost all poisoning attempts; real dust transfers are a small minority. - USDT dust transfers on Ethereum rose from 4.2 million to 29.9 million in the 90 days after the 3 December 2025 Fusaka upgrade, per Etherscan. - The fix is procedural: never copy from history, compare the full address, use a saved address book and confirm on a hardware wallet screen. ## What is address poisoning? Address poisoning is a social engineering attack that targets how people copy wallet addresses, not the security of the wallet itself. Ethereum-style addresses are 40-character hexadecimal strings, and most wallets and block explorers show only the first and last few characters. Attackers generate a "vanity" address that matches those visible characters and push it into your activity list ([CyLab, Carnegie Mellon University](https://www.cylab.cmu.edu/news/2026/01/07-blockchain-address-poisoning.html)). Nothing is hacked. Address poisoning "does not compromise your private keys or Secret Recovery Phrase," says [Ledger](https://support.ledger.com/article/address-poisoning-scams). The loss happens only if you later pick the fake as a recipient, and on-chain transfers are final. ## How does address poisoning work? Address poisoning works by exploiting the gap between the short address a wallet displays and the full address the blockchain uses. The USENIX paper and wallet help pages describe the same four-step sequence ([USENIX paper](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf); [MetaMask Help Center](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)): 1. **You make a normal transfer.** You send USDT or USDC to an exchange, a colleague or another of your own wallets. Bots monitoring stablecoin transfers flag the transaction; the paper found attacks typically land soon after the original transfer, mostly within 20 minutes. 2. **A bot generates a lookalike.** Vanity-address software produces an address whose leading and trailing characters match your counterparty. Most groups in the study matched up to 14 characters; one large group reached 20, which the authors attribute to GPU-scale computing. 3. **Your history is poisoned.** The attacker sends a zero-value transfer, a tiny amount of the same token, or a fake token from the lookalike address so it appears next to the real one in your activity. 4. **You copy the fake.** On your next payment you copy what looks like the familiar address from history. The funds go to the attacker, who often swaps them out within minutes. ![Four-step diagram of address poisoning: you transfer, a bot makes a lookalike, poisons your history, you copy the fake](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/11/how-address-poisoning-works-steps-diagram.webp) Graphic: Stablecoin Insider. Source: [Tsuchiya et al., USENIX Security 2025](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf); [MetaMask Help Center](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/); [Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/), read 11 Nov 2026. Test transfers do not help if you copy the main address from history afterwards. In December 2025 one victim sent a $50 test transaction to the correct address first, then copied the poisoned address from history and sent $49,999,950 USDT to the scammer ([CoinDesk](https://www.coindesk.com/web3/2025/12/20/crypto-user-loses-usd50-million-in-address-poisoning-scam)). ## What are the three types of address poisoning transfers? The three types of address poisoning transfers are tiny transfers, zero-value transfers and counterfeit-token transfers. The table compares how each one works and how often the USENIX researchers saw it across Ethereum and BSC; counts link to the paper. | Type | How it works | What you see in history | Attempts, Jul 2022 to Jun 2024 | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | **Zero-value transfer** | Uses the token's public transferFrom function, which lets anyone log a 0-token transfer that appears to come from your wallet | An outgoing transfer of 0 USDT or USDC to the lookalike, as if you had paid it before | 147.7 million ([USENIX, Table 1](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)) | | **Counterfeit-token transfer** | Attacker deploys a fake token with a similar name and moves it on your behalf, since they control its code | A transfer of a token named like USDT, sometimes with a Cyrillic letter, to or from the lookalike | 118.4 million ([USENIX, Table 1](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)) | | **Tiny (dust) transfer** | Attacker sends a small amount of the real token from the lookalike to you | An incoming transfer of a few cents of the same stablecoin you just used | 3.96 million ([USENIX, Table 1](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)) | ![Bar chart: zero-value transfers 147.7M and fake-token transfers 118.4M dwarf 3.96M tiny dust transfers in poisoning attempts](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/11/address-poisoning-transfers-by-type-ethereum-bsc-chart.webp) Source: [Tsuchiya et al., Blockchain Address Poisoning, USENIX Security 2025, Table 1](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf), read 11 Nov 2026. Two patterns stand out. First, most attacks cost nothing in tokens, only gas. The researchers call zero-value transfers "potentially even more dangerous" than dust, because they make it look as if you paid the lookalike yourself ([USENIX paper](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)). Second, fake tokens borrow trust from real ones: out of 5,838 counterfeit tokens the team found, at least 740 used alternative encodings of USDT or USDC, such as a Cyrillic "S" or "T". ## Why are USDT and USDC the main targets? USDT and USDC are the main targets because they are the tokens people most often send in size to repeat counterparties, and attackers watch for exactly those transfers. MetaMask's help page says the monitoring software attackers use watches transfers of "certain tokens (usually stablecoins)" ([MetaMask Help Center](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)). The USENIX study built its detector around Tether, USD Coin and DAI on Ethereum and the main dollar stablecoins on BSC, and found that the seven largest attack groups all targeted addresses holding significantly more stablecoins than regular USDT users ([USENIX paper](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)). Ledger adds that poisoning is most common on low-fee chains, naming Polygon, Tron, Tezos, Solana and BNB Smart Chain, "but they can happen on any chain" ([Ledger Support](https://support.ledger.com/article/address-poisoning-scams)). Because USDT and USDC issuers can block addresses, thieves swap quickly: the $50 million USDT haul was converted to ether and partly routed through Tornado Cash ([CoinDesk](https://www.coindesk.com/web3/2025/12/20/crypto-user-loses-usd50-million-in-address-poisoning-scam)). Blockchain intelligence firm Whitestream said, as reported by [Cointelegraph](https://cointelegraph.com/news/over-62m-lost-address-poisoning-since-december-scam-sniffer), that DAI has become a preferred "parking place" for illicit funds because its governance does not freeze wallets. For how issuer freezes work, see our guide on [whether stablecoins can be frozen](https://stablecoininsider.org/can-stablecoins-be-frozen/). ## Why did address poisoning surge after Ethereum's Fusaka upgrade? Address poisoning surged after Ethereum's Fusaka upgrade because lower transaction fees made mass dust campaigns cheap. Fusaka activated on 3 December 2025, and in the following 90 days Ethereum processed about 30% more transactions per day while dust transfers under $0.01 jumped for every major stablecoin ([Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/)). ![Bar chart: Ethereum dust transfers rose from 4.2M to 29.9M for USDT, 2.6M to 14.9M for USDC after Fusaka](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/11/usdt-usdc-dai-dust-transfers-before-after-fusaka-bar-chart.webp) Source: [Etherscan Information Center, Address Poisoning Attacks Are Rising on Ethereum](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/), read 11 Nov 2026. Coin Metrics found the same from a different dataset: of 227 million USDC and USDT balance updates on Ethereum from November 2025 through January 2026, 85.9 million (38%) were under one cent. One sender pushed nearly 3 million dust transfers to more than 1 million addresses for about $5,175 in stablecoins ([Coin Metrics State of the Network #349](https://www.talos.com/insights/state-of-the-network-349)). Only about one in 10,000 attempts succeeds, yet some groups earn 10 to 20 times what they spend on fees and infrastructure ([CyLab](https://www.cylab.cmu.edu/news/2026/01/07-blockchain-address-poisoning.html)). ## How much money has address poisoning stolen? Address poisoning has stolen at least $83.8 million on Ethereum and BSC in the two years the USENIX team measured, and two single thefts since December 2025 added more than $62 million. The table lists measured totals and the largest reported cases; each row links to its source. | Period or date | Loss | Chain and asset | Source | | -------------------- | ------------------------------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | Jul 2022 to Jun 2024 | $79.3M from 1,502 victims (median $2,160; largest $20M) | Ethereum, stablecoins | [USENIX, Table 2](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf) | | Jul 2022 to Jun 2024 | $4.49M from 4,004 victims (median loss $85) | BSC, stablecoins | [USENIX, Table 2](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf) | | 19 Dec 2025 | $49,999,950 after a $50 test transfer | Ethereum, USDT | [CoinDesk](https://www.coindesk.com/web3/2025/12/20/crypto-user-loses-usd50-million-in-address-poisoning-scam) | | Jan 2026 | $12.2M in a single theft | Not specified | [Cointelegraph, citing Scam Sniffer](https://cointelegraph.com/news/over-62m-lost-address-poisoning-since-december-scam-sniffer) | Two patterns stand out here too. Ethereum losses are far larger per victim (median $2,160 versus $85 on BSC), even though BSC saw about 14.5 times more poisoning transfers. And repeat mistakes happen: the paper records one victim who sent 1.999 million and then 2 million USDC to an attacker within 10 blocks ([USENIX paper](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)). 💡 **Stablecoin Insider's take:** address poisoning is the cheapest attack in crypto to run and the easiest to defeat. It needs no exploit, only a habit. Any desk that moves stablecoins in size should treat copying from transaction history as a policy violation, the same way a bank treats a payment to an unverified account change. ## How do you avoid address poisoning? You avoid address poisoning by never trusting an address you did not get from its original source, and by checking the whole string before you sign. These seven steps follow guidance from MetaMask, Ledger, Etherscan and the CMU researchers: 1. **Never copy from transaction history.** Get the address from the recipient, the exchange's deposit screen or your own wallet's receive screen. MetaMask says this applies to your own addresses too ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)). 2. **Compare the middle characters.** Lookalikes match the start and end, so the middle is where the fake differs ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)). 3. **Save verified addresses.** Use your wallet's address book or contacts list; a saved entry cannot be changed by a poisoning transfer. Etherscan also recommends private name tags and [ENS names](https://docs.ens.domains/) so real counterparties stand out ([Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/)). 4. **Confirm on a hardware wallet screen.** [Ledger](https://support.ledger.com/article/address-poisoning-scams) tells users to verify the destination on the device, "checking every character, not just the first or last few." 5. **Re-copy after a test transfer.** If you send a test, copy the address again from the original source for the main transfer; the $50 million victim did a test and still lost ([CoinDesk](https://www.coindesk.com/web3/2025/12/20/crypto-user-loses-usd50-million-in-address-poisoning-scam)). 6. **Treat unexpected tiny or zero-value transfers as a warning.** The CMU team advises being wary of them and whitelisting trusted addresses ([CyLab](https://www.cylab.cmu.edu/news/2026/01/07-blockchain-address-poisoning.html)). 7. **Keep wallet warnings on.** Since 17 June 2026 MetaMask shows a blocking warning before sends to addresses that resemble ones you have used, and a warning on first-time recipients across EVM networks ([MetaMask](https://metamask.com/news/address-poisoning-detection)). The checklist below maps each control to what it stops and who documents it. | Control | What it stops | Documented by | | ------------------------------------ | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Copy from source, never from history | Selecting the poisoned entry in your activity list | [MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/), [Ledger](https://support.ledger.com/article/address-poisoning-scams) | | Full-string comparison | Lookalikes that match only the first and last characters | [MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/), [Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/) | | Address book, name tags, ENS | Pasting an unlabelled lookalike | [Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/), [MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/) | | Hardware wallet confirmation | Last-step mistakes and clipboard swaps | [Ledger](https://support.ledger.com/article/address-poisoning-scams) | | Lookalike-detection warnings | Sends to near-duplicates of past recipients | [MetaMask](https://metamask.com/news/address-poisoning-detection) | 🔎 **How we checked this guide:** we read the USENIX Security 2025 paper and its data tables, Etherscan's March 2026 analysis, Coin Metrics' February 2026 report, and the MetaMask and Ledger help pages, all on 11 November 2026\. Loss figures come from the paper or from news reports citing on-chain investigators. No provider paid for placement. See [our methodology](https://stablecoininsider.org/our-methodology/). ## What should you do if you sent funds to a poisoned address? If you sent funds to a poisoned address, you should act within minutes, because attackers often swap stablecoins into assets that cannot be frozen. For the largest theft in the USENIX dataset, Tether blocked the attacker's address within an hour, which stopped the funds from moving on ([USENIX paper](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)). - Contact the stablecoin issuer and, if the funds came from or went to an exchange, that exchange's support team, with the transaction hash and both addresses. Check freeze status with our guides for [USDT](https://stablecoininsider.org/how-to-check-usdt-blacklist-status/) and [USDC](https://stablecoininsider.org/how-to-check-usdc-blacklist-status/). - File a report with law enforcement; in the US that is the FBI's [Internet Crime Complaint Center (IC3)](https://www.ic3.gov/). ## Can wallets and token contracts stop address poisoning? Wallets and token contracts can reduce address poisoning but cannot fully stop it. The ERC-20 standard says transfers of 0 values "MUST be treated as normal transfers and fire the Transfer event" ([EIP-20](https://eips.ethereum.org/EIPS/eip-20)), and that is what lets anyone log a zero-value transfer from your address. OpenZeppelin considered blocking zero-allowance `transferFrom` calls in its ERC-20 code but decided against it on 15 February 2023, citing the risk of breaking DeFi contracts ([OpenZeppelin GitHub issue #3931](https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3931)). Deployed stablecoin contracts are unchanged, so the fix sits with interfaces: Etherscan hides zero-value transfers by default, labels spoofing addresses and highlights matching addresses ([Etherscan](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/)), while MetaMask now shows more of each address, for example 0xEdf89FdA047F28…C6341a8ff7ED instead of 0xEdf89…ff7ED ([MetaMask](https://metamask.com/news/address-poisoning-detection)). ## Stablecoin Insider's verdict on address poisoning Address poisoning profits from one habit: copying an address from history and checking only its ends. Fusaka made the attack cheaper, and stablecoins remain the bait. The defence costs nothing: verified address books, full-string checks and hardware confirmation. Treasury teams should write all three into payment policy. [Stablecoin Scams: The Top 10 Patterns and How to Spot Them FastThe ten scam patterns that target stablecoin holders, from fake tokens to approval phishing.![](https://stablecoininsider.org/favicon.ico)Stablecoin Insider](https://stablecoininsider.org/stablecoin-scams/) [Can Stablecoins Be Frozen? Blacklisting Explained (2026)How Tether, Circle and other issuers freeze addresses, and what that means after a theft.![](https://stablecoininsider.org/favicon.ico)Stablecoin Insider](https://stablecoininsider.org/can-stablecoins-be-frozen/) [How to Store Stablecoins Securely in a Wallet in 2026Wallet types, custody choices and the security settings that matter for stablecoin holders.![](https://stablecoininsider.org/favicon.ico)Stablecoin Insider](https://stablecoininsider.org/store-stablecoins-securely/) Moving stablecoins between chains as well? See how to [transfer stablecoins across blockchains](https://stablecoininsider.org/transfer-stablecoins-across-blockchains/) without sending to the wrong network. [See the 10 most common stablecoin scams](https://stablecoininsider.org/stablecoin-scams/) Related hub: see our [Stablecoin Payments and Cards Hub](https://stablecoininsider.org/stablecoin-payments-hub/) for every guide on sending, receiving and spending stablecoins. ## FAQ #### What is address poisoning in crypto? Address poisoning in crypto is a scam where an attacker sends a zero-value, dust or fake-token transfer from a lookalike address so it appears in your history. If you later copy that address, your funds go to the attacker (MetaMask Help Center). #### Can address poisoning steal funds without my approval? Address poisoning cannot steal funds without your approval. It does not touch your keys or seed phrase; the loss happens only when you sign a transfer to the lookalike address (Ledger Support). #### Why did I receive 0 USDT from an unknown address? You received 0 USDT from an unknown address because someone used the token's public transferFrom function to log a zero-value transfer, a common poisoning technique. The USENIX study counted 147.7 million such transfers on Ethereum and BSC in two years (USENIX paper). Ignore it and never copy that address. #### Does a test transaction protect me from address poisoning? A test transaction does not protect you from address poisoning if you copy the main address from history afterwards. The victim who lost $49,999,950 USDT in December 2025 had sent a $50 test to the correct address first (CoinDesk). #### Can stolen USDT or USDC be frozen after address poisoning? Stolen USDT or USDC can be frozen after address poisoning only if the issuer acts before the attacker swaps it. Tether froze the attacker's address within an hour in the largest case in the USENIX dataset, but many thieves convert to ether within minutes (USENIX paper; CoinDesk). #### Which blockchains are affected by address poisoning? The blockchains affected by address poisoning include Ethereum and BNB Smart Chain, where it has been measured at scale, plus low-fee networks such as Polygon, Tron, Tezos and Solana, according to Ledger. Attackers reuse lookalike addresses across EVM chains because the address format is the same (CyLab). *Sources:* [*Tsuchiya, Dong, Soska and Christin, Blockchain Address Poisoning, USENIX Security 2025*](https://www.usenix.org/conference/usenixsecurity25/presentation/tsuchiya) *(*[*PDF*](https://www.usenix.org/system/files/usenixsecurity25-tsuchiya.pdf)*;* [*arXiv*](https://arxiv.org/abs/2501.16681)*);* [*CyLab, Carnegie Mellon University, 7 Jan 2026*](https://www.cylab.cmu.edu/news/2026/01/07-blockchain-address-poisoning.html)*;* [*Etherscan Information Center, 9 Mar 2026*](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum/)*;* [*Coin Metrics State of the Network #349, 3 Feb 2026*](https://www.talos.com/insights/state-of-the-network-349)*;* [*CoinDesk, 20 Dec 2025*](https://www.coindesk.com/web3/2025/12/20/crypto-user-loses-usd50-million-in-address-poisoning-scam)*;* [*Cointelegraph, 9 Feb 2026*](https://cointelegraph.com/news/over-62m-lost-address-poisoning-since-december-scam-sniffer)*;* [*MetaMask Help Center*](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)*;* [*MetaMask, 17 Jun 2026*](https://metamask.com/news/address-poisoning-detection)*;* [*Ledger Support*](https://support.ledger.com/article/address-poisoning-scams)*;* [*EIP-20*](https://eips.ethereum.org/EIPS/eip-20)*;* [*OpenZeppelin issue #3931*](https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3931)*;* [*ENS documentation*](https://docs.ens.domains/)*;* [*FBI IC3*](https://www.ic3.gov/)*. All read on 11 November 2026.* --- This content is provided for informational and educational purposes only and doesn't constitute financial, investment, legal or tax advice. Attack and loss figures were read on 11 November 2026 from the USENIX Security 2025 paper, Etherscan, Coin Metrics and the news reports cited, and cover the periods those sources state. Wallet features may change. Mentions of USDT, USDC, DAI, Tether, Circle, MetaMask, Ledger, Etherscan or any other company or asset are not endorsements. Speak to a qualified professional before making financial decisions.