Address poisoning: the scam hiding in your transaction history
A tiny transfer arrives from an address that looks almost exactly like yours, in the hope that you copy it by mistake. Here is how to spot it.
Address poisoning is a simple trick, and it still works. The scammer watches the chain for wallets that send often. Then they generate an address that starts and ends with the same characters as one you use. From that lookalike address they send you a tiny amount, or a fake token. And there it sits, in your transaction history.
Next time you send, you open your history, copy what looks like your usual address and paste it. The first four characters match. So do the last four. The ones in the middle do not. The coins end up with the scammer.
Where it happens most
It is most common on networks with cheap transfers and popular stablecoins, such as Tron and Ethereum compatible chains. If you move USDT regularly, assume you will be targeted at some point.
How to protect yourself
- Never copy an address from your transaction history. Use your wallet's address book or copy it again from the original source.
- Check the whole address, not just the start and the end. Read the middle too.
- Send a small test amount first when the amount matters.
- Be wary of zero value transfers or tokens you never asked for.
How Swapea makes it harder
Every swap gets a new, single use deposit address, shown on your swap page next to a QR code. You never need to copy a deposit address from your history, because you should never reuse one. Paste your receiving address from your wallet's Receive screen, not from an old transaction. For more tips, see our guide to clipboard malware.
Questions
Can address poisoning steal funds from my wallet directly?
No. It cannot move your coins. It only works if you copy the fake address yourself and send to it.
Should I hide or ignore those dust transfers?
Many wallets let you hide spam tokens and tiny transfers. Hiding them is fine. Never interact with them, and never copy an address from that history.
