Why Address Poisoning Can Trick Your Transaction History
Address poisoning tricks your transaction history not by breaking encryption or stealing your private key, but by precisely exploiting how wallet interfaces display addresses—most wallets only show the first and last few characters. You trust your own history, but a shadow address that looks nearly identical has been planted in it.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
This is essentially a psychological ambush on the "copy-paste" workflow. The attacker doesn't need your authorization or signature—they only need you to copy the wrong address from your history the next time you make a transfer. Here's the full process of how it happens inside your wallet.
Prerequisites
- You have used a wallet to transfer cryptocurrency.
- You know that a wallet address is typically a long string starting with 0x, which is usually hard to memorize in full.
- You are aware of how wallet interfaces display addresses (usually only the first and last few characters).
Step 1: The attacker generates a "shadow address"
Your commonly used receiving address might look like this (example only):
0x742d35Cc6634C0532925a3b844Bc454e4438f44e
The attacker doesn't try to guess your private key. They use a "vanity address generator" to brute-force a wallet address that matches the first and last few characters exactly with your address. For example:
0x742d35Cc6634C0532925a3b844Bc454e4438f4Ae
Look closely: both start with 0x742d35, both end with 4438f44e, but the capitalization differs slightly. Many users who only glance at the start and end will easily fall for it.
Cost is extremely low: generating such an address costs almost nothing, and attackers can batch-generate countless addresses that are difficult to distinguish.
Completion standard: Understand that the attacker generates a fake address that matches at the beginning and end but differs in the middle.
Step 2: The attacker "poisons" your transaction history
After generating the shadow address, the attacker needs to get it into your wallet. They typically do this via:
Case A: Zero-value transfer The attacker uses a token contract's transferFrom function to send a 0 USDT transaction from your wallet to their shadow address. This transaction does not require your private key signature, but it will appear in your transaction history.
Case B: Extremely small transfer (dust attack) The attacker sends a real, tiny transfer from their shadow address to your wallet, like 0.00001 USDT. Because it's real money, it will directly appear in your wallet's "recent transactions" list.
Completion standard: Your transaction history now contains a transaction from the shadow address. It blends in with your other history entries and looks like an address you've transacted with before.
Step 3: Waiting for you to "copy the wrong address"
This is the final step, where the attacker actually succeeds.
Days or even weeks later, when you need to transfer funds to that commonly used address again, you open your wallet, find that familiar address from the "transaction history"—the first and last characters match—click copy, then paste it into the recipient field.
You see the start 0x742d35, the end 4438f44e, it looks completely correct, and you hit send. The funds go to the attacker's wallet.
This is why "address poisoning" is called a psychological ambush: the attacker tampers not with the code, but with your chain of trust.
Completion standard: You confirm you understand the complete attack chain: generate shadow address → plant in history → trick into copying.
Common failure reasons
The biggest misconception: thinking "address poisoning" requires clicking a phishing link or approving a signature.
The entire address poisoning attack requires no signatures, no clicking, and no contract approvals from you. It relies solely on you actively copying an address from your history the next time. Even if you are highly security-conscious, as long as you have the habit of copying addresses from history, you can fall victim.
Risk alerts
- The attack has become industrialized: After Ethereum's Fusaka upgrade in December 2025, on-chain fees dropped, significantly lowering the cost for attackers to broadcast dust transactions. From November 2025 to January 2026, monthly poisoning attempts surged from 628,000 to 3.4 million. This is not a rare occasional event.
- A real cost of $50 million: In December 2025, a user first sent a $50 test transfer. The attacker generated a shadow address and poisoned within minutes after that test. 26 minutes later, the user mistakenly transferred roughly $50 million in USDT to the attacker.
- Attackers "snipe" your test transfers: Some attackers monitor on-chain transactions. When you initiate a small test transfer, they quickly generate and plant a shadow address before your large actual transfer, turning the test transfer itself into a trap.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
How to confirm the operation is completed
- Verify the full address: Don't just look at the start and end; check the middle part character by character. It's extremely hard for attackers to generate an address that also matches in the middle.
- Clean up transaction history: If you notice multiple abnormal zero-value or extremely small transfers in your history, don't copy addresses from there.
- Build an address book: Save frequently used addresses in your wallet's address book with clear memo names. When transferring, select from the address book instead of copying from transaction history. This is the most thorough step.
