← All guidesGuide · 5 min read

Address poisoning: the copy-paste scam that steals large transfers

Last updated

Address poisoning doesn’t hack anything. It counts on a habit almost everyone has: copying an address from your recent transactions instead of from the original source.

How it works

  1. You send crypto to an address you use often, for example 0x71C4…9A2f.
  2. A bot sees it and creates a new address that starts and ends with the same characters: 0x71C4…9A2f. The middle is completely different.
  3. The scammer sends you a tiny or zero-value transfer from that look-alike address, so it appears in your history right next to the real one.
  4. Next time, you copy “the address from last time,” grab the fake one, and send your funds to the scammer.

Wallets and explorers usually shorten addresses to the first and last few characters, which is exactly what the scammer copies. Single mistakes like this have cost people millions of dollars.

See how easy it is

Move the slider to choose how many characters you usually check. The scammer only has to match those.

If you check the first 4 and last 4 characters, a scammer needs to match 8 hexadecimal characters, about 4 billion possibilities. One high-end graphics card can do that in seconds. Matching 20 characters would take millions of years, which is why checking more of the address, or using an address book, protects you.
The rule: never copy a destination address from your transaction history or a block explorer's list of transfers.

Five habits that stop it

  1. Use your wallet’s address book. Save addresses you send to often, and pick from the address book every time.
  2. Copy from the source. Get the address from the exchange’s deposit page or directly from the person you’re paying.
  3. Check the middle, too. Compare several characters from the middle of the address, not just the start and end.
  4. Send a test transaction for large amounts, and have the recipient confirm it arrived before you send the rest.
  5. Ignore surprise tiny transfers. A zero-value or dust transfer from an address you don’t know is a warning sign. Don’t interact with it.

On a hardware wallet

Your hardware wallet shows the full address on its own screen before you approve. Read it there, not only on your computer. See our hardware wallet setup guide for more.