Table of Contents
Address poisoning is a scam in which an attacker plants a lookalike wallet address in your transaction history, usually with a zero-value or dust stablecoin transfer, and waits for you to copy it. The fake matches the first and last characters of an address you use, so your next payment goes to the attacker, irreversibly.
The scale is industrial. A Carnegie Mellon study presented at USENIX Security 2025 counted about 270 million poisoning attempts against 17 million victims on Ethereum and BNB Smart Chain between July 2022 and June 2024, with at least $83.8 million stolen (Tsuchiya et al., USENIX Security 2025). After Ethereum's Fusaka upgrade cut fees on 3 December 2025, USDT dust transfers on Ethereum rose 612% in 90 days, according to Etherscan.
This guide covers how an attack works, the three transfer types attackers use, why stablecoins are the bait, how much has been lost, and the checks that stop it.
Last updated: 11 November 2026. Figures and wallet features re-checked against the research paper, Etherscan, Coin Metrics and wallet help pages on this date.
Key Takeaways
- Address poisoning does not steal keys or exploit code; it relies on you copying a lookalike address from your own transaction history.
- Researchers found about 270 million poisoning attempts against 17 million victims on Ethereum and BSC from July 2022 to June 2024, with at least $83.8 million lost.
- Zero-value transfers (147.7 million) and counterfeit-token transfers (118.4 million) make up almost all poisoning attempts; real dust transfers are a small minority.
- USDT dust transfers on Ethereum rose from 4.2 million to 29.9 million in the 90 days after the 3 December 2025 Fusaka upgrade, per Etherscan.
- The fix is procedural: never copy from history, compare the full address, use a saved address book and confirm on a hardware wallet screen.
What is address poisoning?
Address poisoning is a social engineering attack that targets how people copy wallet addresses, not the security of the wallet itself. Ethereum-style addresses are 40-character hexadecimal strings, and most wallets and block explorers show only the first and last few characters. Attackers generate a "vanity" address that matches those visible characters and push it into your activity list (CyLab, Carnegie Mellon University).
Nothing is hacked. Address poisoning "does not compromise your private keys or Secret Recovery Phrase," says Ledger. The loss happens only if you later pick the fake as a recipient, and on-chain transfers are final.
How does address poisoning work?
Address poisoning works by exploiting the gap between the short address a wallet displays and the full address the blockchain uses. The USENIX paper and wallet help pages describe the same four-step sequence (USENIX paper; MetaMask Help Center):
- You make a normal transfer. You send USDT or USDC to an exchange, a colleague or another of your own wallets. Bots monitoring stablecoin transfers flag the transaction; the paper found attacks typically land soon after the original transfer, mostly within 20 minutes.
- A bot generates a lookalike. Vanity-address software produces an address whose leading and trailing characters match your counterparty. Most groups in the study matched up to 14 characters; one large group reached 20, which the authors attribute to GPU-scale computing.
- Your history is poisoned. The attacker sends a zero-value transfer, a tiny amount of the same token, or a fake token from the lookalike address so it appears next to the real one in your activity.
- You copy the fake. On your next payment you copy what looks like the familiar address from history. The funds go to the attacker, who often swaps them out within minutes.
Test transfers do not help if you copy the main address from history afterwards. In December 2025 one victim sent a $50 test transaction to the correct address first, then copied the poisoned address from history and sent $49,999,950 USDT to the scammer (CoinDesk).
What are the three types of address poisoning transfers?
The three types of address poisoning transfers are tiny transfers, zero-value transfers and counterfeit-token transfers. The table compares how each one works and how often the USENIX researchers saw it across Ethereum and BSC; counts link to the paper.
| Type | How it works | What you see in history | Attempts, Jul 2022 to Jun 2024 |
|---|---|---|---|
| Zero-value transfer | Uses the token's public transferFrom function, which lets anyone log a 0-token transfer that appears to come from your wallet | An outgoing transfer of 0 USDT or USDC to the lookalike, as if you had paid it before | 147.7 million (USENIX, Table 1) |
| Counterfeit-token transfer | Attacker deploys a fake token with a similar name and moves it on your behalf, since they control its code | A transfer of a token named like USDT, sometimes with a Cyrillic letter, to or from the lookalike | 118.4 million (USENIX, Table 1) |
| Tiny (dust) transfer | Attacker sends a small amount of the real token from the lookalike to you | An incoming transfer of a few cents of the same stablecoin you just used | 3.96 million (USENIX, Table 1) |
Two patterns stand out. First, most attacks cost nothing in tokens, only gas. The researchers call zero-value transfers "potentially even more dangerous" than dust, because they make it look as if you paid the lookalike yourself (USENIX paper). Second, fake tokens borrow trust from real ones: out of 5,838 counterfeit tokens the team found, at least 740 used alternative encodings of USDT or USDC, such as a Cyrillic "S" or "T".
Why are USDT and USDC the main targets?
USDT and USDC are the main targets because they are the tokens people most often send in size to repeat counterparties, and attackers watch for exactly those transfers. MetaMask's help page says the monitoring software attackers use watches transfers of "certain tokens (usually stablecoins)" (MetaMask Help Center).
The USENIX study built its detector around Tether, USD Coin and DAI on Ethereum and the main dollar stablecoins on BSC, and found that the seven largest attack groups all targeted addresses holding significantly more stablecoins than regular USDT users (USENIX paper). Ledger adds that poisoning is most common on low-fee chains, naming Polygon, Tron, Tezos, Solana and BNB Smart Chain, "but they can happen on any chain" (Ledger Support).
Because USDT and USDC issuers can block addresses, thieves swap quickly: the $50 million USDT haul was converted to ether and partly routed through Tornado Cash (CoinDesk). Blockchain intelligence firm Whitestream said, as reported by Cointelegraph, that DAI has become a preferred "parking place" for illicit funds because its governance does not freeze wallets. For how issuer freezes work, see our guide on whether stablecoins can be frozen.
Why did address poisoning surge after Ethereum's Fusaka upgrade?
Address poisoning surged after Ethereum's Fusaka upgrade because lower transaction fees made mass dust campaigns cheap. Fusaka activated on 3 December 2025, and in the following 90 days Ethereum processed about 30% more transactions per day while dust transfers under $0.01 jumped for every major stablecoin (Etherscan).
Coin Metrics found the same from a different dataset: of 227 million USDC and USDT balance updates on Ethereum from November 2025 through January 2026, 85.9 million (38%) were under one cent. One sender pushed nearly 3 million dust transfers to more than 1 million addresses for about $5,175 in stablecoins (Coin Metrics State of the Network #349).
Only about one in 10,000 attempts succeeds, yet some groups earn 10 to 20 times what they spend on fees and infrastructure (CyLab).
How much money has address poisoning stolen?
Address poisoning has stolen at least $83.8 million on Ethereum and BSC in the two years the USENIX team measured, and two single thefts since December 2025 added more than $62 million. The table lists measured totals and the largest reported cases; each row links to its source.
| Period or date | Loss | Chain and asset | Source |
|---|---|---|---|
| Jul 2022 to Jun 2024 | $79.3M from 1,502 victims (median $2,160; largest $20M) | Ethereum, stablecoins | USENIX, Table 2 |
| Jul 2022 to Jun 2024 | $4.49M from 4,004 victims (median loss $85) | BSC, stablecoins | USENIX, Table 2 |
| 19 Dec 2025 | $49,999,950 after a $50 test transfer | Ethereum, USDT | CoinDesk |
| Jan 2026 | $12.2M in a single theft | Not specified | Cointelegraph, citing Scam Sniffer |
Two patterns stand out here too. Ethereum losses are far larger per victim (median $2,160 versus $85 on BSC), even though BSC saw about 14.5 times more poisoning transfers. And repeat mistakes happen: the paper records one victim who sent 1.999 million and then 2 million USDC to an attacker within 10 blocks (USENIX paper).
How do you avoid address poisoning?
You avoid address poisoning by never trusting an address you did not get from its original source, and by checking the whole string before you sign. These seven steps follow guidance from MetaMask, Ledger, Etherscan and the CMU researchers:
- Never copy from transaction history. Get the address from the recipient, the exchange's deposit screen or your own wallet's receive screen. MetaMask says this applies to your own addresses too (MetaMask).
- Compare the middle characters. Lookalikes match the start and end, so the middle is where the fake differs (MetaMask).
- Save verified addresses. Use your wallet's address book or contacts list; a saved entry cannot be changed by a poisoning transfer. Etherscan also recommends private name tags and ENS names so real counterparties stand out (Etherscan).
- Confirm on a hardware wallet screen. Ledger tells users to verify the destination on the device, "checking every character, not just the first or last few."
- Re-copy after a test transfer. If you send a test, copy the address again from the original source for the main transfer; the $50 million victim did a test and still lost (CoinDesk).
- Treat unexpected tiny or zero-value transfers as a warning. The CMU team advises being wary of them and whitelisting trusted addresses (CyLab).
- Keep wallet warnings on. Since 17 June 2026 MetaMask shows a blocking warning before sends to addresses that resemble ones you have used, and a warning on first-time recipients across EVM networks (MetaMask).
The checklist below maps each control to what it stops and who documents it.
| Control | What it stops | Documented by |
|---|---|---|
| Copy from source, never from history | Selecting the poisoned entry in your activity list | MetaMask, Ledger |
| Full-string comparison | Lookalikes that match only the first and last characters | MetaMask, Etherscan |
| Address book, name tags, ENS | Pasting an unlabelled lookalike | Etherscan, MetaMask |
| Hardware wallet confirmation | Last-step mistakes and clipboard swaps | Ledger |
| Lookalike-detection warnings | Sends to near-duplicates of past recipients | MetaMask |
What should you do if you sent funds to a poisoned address?
If you sent funds to a poisoned address, you should act within minutes, because attackers often swap stablecoins into assets that cannot be frozen. For the largest theft in the USENIX dataset, Tether blocked the attacker's address within an hour, which stopped the funds from moving on (USENIX paper).
- Contact the stablecoin issuer and, if the funds came from or went to an exchange, that exchange's support team, with the transaction hash and both addresses. Check freeze status with our guides for USDT and USDC.
- File a report with law enforcement; in the US that is the FBI's Internet Crime Complaint Center (IC3).
Can wallets and token contracts stop address poisoning?
Wallets and token contracts can reduce address poisoning but cannot fully stop it. The ERC-20 standard says transfers of 0 values "MUST be treated as normal transfers and fire the Transfer event" (EIP-20), and that is what lets anyone log a zero-value transfer from your address.
OpenZeppelin considered blocking zero-allowance transferFrom calls in its ERC-20 code but decided against it on 15 February 2023, citing the risk of breaking DeFi contracts (OpenZeppelin GitHub issue #3931). Deployed stablecoin contracts are unchanged, so the fix sits with interfaces: Etherscan hides zero-value transfers by default, labels spoofing addresses and highlights matching addresses (Etherscan), while MetaMask now shows more of each address, for example 0xEdf89FdA047F28…C6341a8ff7ED instead of 0xEdf89…ff7ED (MetaMask).
Stablecoin Insider's verdict on address poisoning
Address poisoning profits from one habit: copying an address from history and checking only its ends. Fusaka made the attack cheaper, and stablecoins remain the bait. The defence costs nothing: verified address books, full-string checks and hardware confirmation. Treasury teams should write all three into payment policy.
Moving stablecoins between chains as well? See how to transfer stablecoins across blockchains without sending to the wrong network.
Related hub: see our Stablecoin Payments and Cards Hub for every guide on sending, receiving and spending stablecoins.
FAQ
What is address poisoning in crypto?
Can address poisoning steal funds without my approval?
Why did I receive 0 USDT from an unknown address?
Does a test transaction protect me from address poisoning?
Can stolen USDT or USDC be frozen after address poisoning?
Which blockchains are affected by address poisoning?
Sources: Tsuchiya, Dong, Soska and Christin, Blockchain Address Poisoning, USENIX Security 2025 (PDF; arXiv); CyLab, Carnegie Mellon University, 7 Jan 2026; Etherscan Information Center, 9 Mar 2026; Coin Metrics State of the Network #349, 3 Feb 2026; CoinDesk, 20 Dec 2025; Cointelegraph, 9 Feb 2026; MetaMask Help Center; MetaMask, 17 Jun 2026; Ledger Support; EIP-20; OpenZeppelin issue #3931; ENS documentation; FBI IC3. All read on 11 November 2026.
This content is provided for informational and educational purposes only and doesn't constitute financial, investment, legal or tax advice. Attack and loss figures were read on 11 November 2026 from the USENIX Security 2025 paper, Etherscan, Coin Metrics and the news reports cited, and cover the periods those sources state. Wallet features may change. Mentions of USDT, USDC, DAI, Tether, Circle, MetaMask, Ledger, Etherscan or any other company or asset are not endorsements. Speak to a qualified professional before making financial decisions.
