Short answer
Address poisoning is a scam in which an attacker plants a lookalike address in your transaction history — same first and last characters, different middle — hoping you copy it next time you send. It cannot take funds on its own; it works only if you paste the wrong address and confirm. The defence is simple: never copy a destination from transaction history, verify the whole address (especially the middle), use a saved address book entry, and confirm on a hardware wallet screen for large amounts.
How the attack works
Etherscan describes three techniques that are often combined (Etherscan: address poisoning):
- Address spoofing: a vanity-address generator creates an address whose first and last characters match one you use. When wallets shorten addresses in the middle, both look identical.
- Token spoofing: a fake token with the same name and symbol as a real one (for example "USDT") is sent to you so the planted transfer looks legitimate.
- Event spoofing: fake transfer events make it look as if you sent funds to the attacker's address before.
MetaMask's help centre summarises the usual sequence: you make a normal transfer; software watching stablecoin transfers spots it; the attacker generates a lookalike address and sends you a zero-value or tiny transfer from it; later you copy that address from history by mistake (MetaMask: address poisoning scams). Confirmed on-chain transfers cannot be reversed.
Address anatomy by chain
Knowing what a valid address looks like on each chain helps you spot the wrong network as well as a spoofed address.
| Chain family | Format | Example prefix | Built-in error check |
|---|---|---|---|
| Ethereum and EVM L2s, BNB Smart Chain, Polygon | 0x + 40 hex characters | 0x… | Optional mixed-case checksum (EIP-55) |
| Tron | Base58Check | T… | Checksum in the encoding |
| Solana | Base58 Ed25519 public key, typically 44 characters | none | None for typos inside a valid key |
Sources: ethereum.org: accounts, ERC-55, NEAR Intents: chain support.
Two consequences. All EVM chains share one format, so a correct-looking 0x address says nothing about the network — see the USDT networks guide. And checksums catch typing errors, not poisoning: a spoofed address is a perfectly valid address.
Pre-send checklist
- Take the address from the source, not from history. Use the recipient's own receive screen, a QR code, or an address-book entry you verified earlier.
- Compare the full string. Check the beginning, the end and at least two groups in the middle. MetaMask specifically advises paying attention to the middle characters.
- Check the network name on the receiving page against the network selected in your wallet.
- Read the token contract, not just the symbol. Fake tokens copy names and symbols; the contract address is what matters.
- Confirm on the device. On a hardware wallet, compare the address shown on the device screen. See the hardware-wallet workflow.
- Test with a small amount for a new destination. Trezor recommends this for large sends, noting it means paying gas twice (Trezor: address poisoning).
Cross-chain specifics
In a cross-chain transfer the destination address is entered on the source chain and used on another chain, so a mistake cannot be seen in the destination wallet until it is too late. Before signing:
- check the destination address on the bridge's confirmation screen, not only in the form;
- if the bridge asks for a refund address, make sure it is yours on the source chain (where refunds go);
- for USDT and USDC, check that the destination token is the one you expect.
What to do if you already sent to a poisoned address
Funds sent to an attacker's address are under the attacker's control. Record the transaction hash, report the address to the explorer and your wallet provider, and be wary of anyone offering paid "recovery". Our incident list tracks protocol-level losses, not individual scams.
FAQ
Can address poisoning steal funds without my signature?
No. The planted transfer does not give the attacker access to your wallet. Loss happens only if you send to the lookalike address yourself.
Should I hide or ignore zero-value transfers in my history?
Hiding them helps, but the main protection is never copying a destination from history.
Does an EIP-55 checksum protect me?
It protects against typos in a mixed-case address, not against a different, valid address that you pasted.
Sources
- Etherscan Information Center: address poisoning attacks — accessed 2026-10-24
- MetaMask Help Center: address poisoning scams — accessed 2026-10-24
- Trezor: what are address poisoning attacks — accessed 2026-10-24
- ERC-55: mixed-case checksum address encoding — accessed 2026-10-24
- ethereum.org: Ethereum accounts — accessed 2026-10-24
- NEAR Intents docs: chain support (address formats) — accessed 2026-10-24