What Is Address Poisoning and How Can a Scammer Insert an Almost Identical Crypto Address
Imagine that you regularly send USDT to the same address.
The real address looks like this:
0x71A3...92F8
After some time, another address appears in your wallet history:
0x71A3...92F8
On the screen, they look almost identical. The user copies the address from the transaction history, sends cryptocurrency — and only later discovers that the full address was different.
This is called Address Poisoning — an attack in which a scammer tries to place a visually similar address into a user’s transaction history.
What Is Address Poisoning?
Address Poisoning is an attack designed to “contaminate” a user’s transaction history with a fake address.
The attacker’s goal is not necessarily to hack the wallet or steal the seed phrase.
Instead, the scammer tries to make their own address appear in your transaction history and look similar to an address you have used before.
Then they hope that during your next transfer, you will:
open the transaction history;
find a familiar-looking address;
copy it;
fail to verify it fully;
send funds to the scammer.
The user signs the transfer themselves.
Why Are Crypto Addresses Easy to Confuse?
An Ethereum or EVM address may look like this:
0x71A3B958D2784F72A91C85E39A649C31949292F8
Checking such a long string character by character is inconvenient.
That is why wallets often shorten it:
0x71A3...92F8
Users become accustomed to checking only:
the first few characters;
the last few characters.
This is exactly what scammers try to exploit.
How Does a Scammer Create a Similar Address?
The attacker analyzes public blockchain transaction history.
Suppose they notice that a user frequently sends funds to:
0x71A3B9...C292F8
The attacker then generates many addresses until they find one that looks similar, for example:
0x71A3B9...7D92F8
The full addresses are completely different.
But in shortened form, both may look almost identical:
Real: 0x71A3...92F8
Fake: 0x71A3...92F8
To an inattentive user, there may appear to be no difference at all.
How Does the Fake Address Appear in the Transaction History?
After creating a similar-looking address, the scammer tries to make it appear in the victim’s transaction history.
This may be done using:
very small transfers;
spam tokens;
certain token transfer events;
other operations that some wallets or blockchain explorers display in transaction history.
As a result, a new record containing the scammer’s address appears alongside legitimate transactions.
That is why the attack is called poisoning — the transaction history is effectively polluted with a fake address.
The Scammer Does Not Need Access to Your Wallet
This is especially important.
With Address Poisoning, the attacker usually does not need:
your seed phrase;
your private key;
your password;
access to your phone;
access to your wallet account.
Blockchain addresses and their transaction histories are public.
The scammer simply relies on the user making a mistake during a future transfer.
Example of an Address Poisoning Attack
Imagine you previously sent USDT to:
0x8F21A4D7...7B5C91E2
Later, a scammer creates:
0x8F21A4D7...7B5C91E2
In a shortened wallet interface, they may appear identical.
But the middle characters are completely different.
The scammer then sends a tiny transaction so that the fake address appears in your history.
A week later, you want to send 5,000 USDT again.
Instead of getting the address directly from the intended recipient, you open your previous transaction history and copy the most recent familiar-looking address.
The transaction succeeds.
But the USDT goes to the scammer.
Why Doesn’t the Blockchain Stop the Transfer?
To the blockchain, the fake address is simply a valid address.
If the user signs a transaction saying:
Send 5,000 USDT → 0x...
the network checks:
whether the signature is valid;
whether the wallet has enough funds;
whether the transaction is valid;
whether the network fee is paid.
But the blockchain does not know who the user intended to pay.
If the wrong address is entered, the network may still execute the transaction normally.
Why Will the Transaction Still Show “Success”?
In a blockchain explorer, the transaction may show:
Success
This does not mean the correct recipient was used.
“Success” only means that the blockchain successfully executed the signed instruction.
So the TXID may look completely normal even though the funds were sent to the wrong person.
Why Is Copying an Address From Transaction History Risky?
Transaction history is convenient.
But it should not automatically be treated as a trusted source of recipient addresses.
You do not fully control what incoming activity appears on your public blockchain address.
Anyone can send:
a tiny amount;
a token;
a spam asset.
That is why the rule:
“I sent there before, so I’ll just copy the address from history”
can be dangerous.
Address Poisoning and Clipboard Malware Are Not the Same Thing
These attacks are sometimes confused.
Address Poisoning
A scammer places a similar-looking address into blockchain transaction history and waits for the user to copy it.
Clipboard Malware
Malware monitors the clipboard.
The user copies the correct address:
0xABC...123
but the malware replaces it with:
0xXYZ...789
These are different attack methods, but the protection is partly the same:
always verify the address in your wallet before confirming the transaction.
Why Checking Only the Last 4 Characters Is Not Enough
The scammer deliberately tries to create an address with similar:
beginning characters;
ending characters.
So checking only:
0x71A3...92F8
may not be enough.
For significant transfers, it is safer to:
use a previously verified address book entry;
obtain the address from a current trusted source;
compare more characters;
verify the full address when necessary;
make a small test transfer first.
What Is a Vanity Address?
An address deliberately generated to contain a specific sequence of characters at the beginning or end is often called a vanity address.
A computer can generate a large number of keys until it finds an address with the desired pattern.
For example, the attacker does not need to reproduce the entire address.
They may only need something like:
Real:
0xA72F93............91C8
Fake:
0xA72F93............91C8
with completely different characters in the middle.
The more matching characters required, the harder it becomes to generate such an address, but matching a few characters can still be practical.
Can a Scammer Create the Exact Same Address?
In practice, the attack is not about creating a fully identical address.
Without the corresponding private key, an attacker cannot simply take control of an existing address.
Address Poisoning has a much simpler goal:
create a different address that looks similar enough.
That is sufficient if the user checks only a small part of the address.
Which Networks Can Be Affected?
Address Poisoning is especially noticeable on networks with long addresses, including EVM-compatible blockchains such as:
Ethereum;
BNB Chain;
Base;
Arbitrum;
Polygon;
others.
But the general idea is not limited to one specific network.
Anywhere users may confuse long identifiers and copy them from transaction history, a similar risk can exist.
What Should You Do With Unknown Micro-Transfers?
If a very small incoming transaction suddenly appears in your wallet, there is no need to panic.
Receiving such a transaction does not usually mean your wallet has been hacked.
But you should not automatically use the sender’s address for future transfers.
If the transaction is unfamiliar:
do not treat that address as a verified contact.
An Address Book Is Safer Than Transaction History
If you regularly send funds to the same recipient, it is better to use:
Address Book / Contacts / Whitelist
if your wallet or service supports it.
The address can be saved after verification and given a clear label, for example:
My Hardware Wallet
or:
Main USDT Address
This reduces the risk of accidentally copying a similar-looking address from transaction history.
But Even an Address Book Should Be Checked
An address book can reduce the risk, but it does not eliminate the need for caution.
Especially before a large transfer, check:
recipient;
address;
network;
token;
amount.
If the recipient tells you that their address has changed, do not replace it based only on a message from an unknown or unverified account.
When Is a Test Transfer Useful?
Before sending a large amount to a new address, you can first send a small test transaction.
For example:
Main transfer: 10,000 USDT
First send:
Test: 10 USDT
Once the recipient confirms that the funds arrived, you can proceed with the main transfer.
A test transfer does not protect against every possible risk, but it can help detect many address or network mistakes before a large amount is sent.
What If the Funds Have Already Been Sent to the Fake Address?
First, find the TXID and confirm exactly where the funds went.
If the transaction is already confirmed and the address belongs to the scammer, the blockchain transaction usually cannot simply be reversed.
You should:
save the TXID;
save the recipient address;
avoid sending any additional funds;
review related transactions;
if possible, contact any service through which the stolen funds later move.
However, recovery after a confirmed transfer is not guaranteed.
What Does This Mean for IXIDE Users?
When exchanging through IXIDE, use only the payment details shown in the current active order.
Do not take the address from:
an old order;
previous transaction history;
a random incoming transaction;
an old message.
Before sending, compare the details with the current order:
cryptocurrency;
network;
address;
amount;
Memo or Tag, if required.
Even if the address looks familiar, that does not automatically mean it is correct.
IXIDE Recommends
Before sending cryptocurrency, follow one simple rule:
Do not copy an address just because it looks familiar.
It is better to obtain the address from a current trusted source and verify it again immediately before confirming the transaction.
For larger amounts, a useful sequence is:
verified address → correct network → test transaction → main transfer.
Key Takeaway
Address Poisoning is not a wallet hack — it is an attempt to trick the user into sending funds to a fake address themselves.
The scammer:
finds the real address → creates a similar one → places it in transaction history → waits for the user to make a mistake.
The main rule is:
do not use transaction history as your only source for a recipient address.
Before every significant transfer, verify the address and network again — even if the address looks familiar.