Address poisoning is a scam where someone plants a wallet address that looks almost exactly like one you have paid before into your transaction history, and the next time you copy that old entry, your funds go to the attacker. I went through Trezor's explainer on it, published on February 13, 2025, and what stayed with me is how little the scam needs from the victim. Nothing gets stolen off your device and nothing gets downloaded. You do the work yourself with a hurried copy and paste. The creator's answer is a habit: never take a receiving address from your history.
What address poisoning does to a transfer
You have paid the same friend a dozen times. Their address sits in your wallet's transaction list, so you open the list, copy the entry, paste it into the send field and confirm. Nothing arrives. Minutes pass, then hours. The payment confirmed on the network, so the coins went somewhere, and the address you pasted was not your friend's.
A blockchain transfer is final once it is confirmed, and the coins belong to whoever controls the private key of the receiving address. There is no support line to call and no chargeback to file. Paste a lookalike by mistake and the money is gone, however clearly you explain afterwards that it was not meant for that address.
The fake entry did not appear by accident. Somebody sent a small transaction from that lookalike address to your address, which put it in your history next to the real one. Weeks later, you do the damage yourself.
Address poisoning also asks nothing of your device: no approval to sign, no seed phrase to type into a fake site. The attacker needs one careless second at the copy button, and the transaction you sign is an ordinary payment to an address you think you recognise.
Why two wallet addresses can look the same
Wallet addresses are long, and they are written in hexadecimal characters: the digits 0 to 9 and the letters A to F. Those letters look like words and are not, so there is nothing familiar in the string to anchor your eye. Nobody reads an address the way they read a name, which is why copying and pasting is standard practice and why the paste is the exact step a scammer attacks.
Set two addresses next to each other and the trick becomes obvious. In the example used, the two strings differ in only a few characters, with long identical stretches in between. A sender who checks quickly sees familiar characters at the start and at the end, and moves on.
I think this works because comparing forty-odd characters is not something people do carefully, even when they intend to. The eye looks for a pattern it recognises and stops there. A lookalike does not have to be perfect. It only has to survive a glance, and surviving a glance is cheap.
The creator puts it plainly: addresses are difficult to memorise, which is why almost everyone copies them instead.
How address poisoning works, from monitoring to the poisoned entry
Every transaction on a public blockchain is visible, whether or not it is tied to a name. A normal payment is enough to put an address on a scammer's radar: it has done something, it appears in a block, and a bot picks it up.
The scammer then generates a vanity address, which is a wallet address built to contain chosen characters. Producing one that resembles yours means running software until it finds a close enough match, and that software needs no name, no phone number and nothing else about you. You are not being singled out. You are an address that looked active.
From the lookalike address, the scammer sends you a tiny transfer. It lands in your history as an ordinary entry. Their hope is that you will not notice it and will copy it later, when you pay the same recipient again.
The fake entry is usually the newest one in a list sorted by date, which is where a hurried sender reaches first. Even if you scroll carefully, the two strings look alike, and nothing in a standard wallet list tells you that one of them was never yours.
The creator's rule is blunt: "you should never copy addresses out of your transaction history." That sentence removes the attack, because the whole method depends on getting an entry into a list you trust.
Dust, zero-value transfers and the blurring feature
Getting an entry into a stranger's history costs almost nothing, but it does cost something, and the difference between the two ways of doing it decides whether a wallet feature catches it.
A zero-value transaction moves nothing. It still costs a small network fee to send, so the attacker pays for the privilege of appearing in your list. Dust is a tiny amount of crypto, fractions of a cent. That transfer carries a real value, if a negligible one, and it shows up as an entry with a number next to it.
| What the attacker sends | What it costs them | What you see in your history | Blurred in the wallet app |
|---|---|---|---|
| Zero-value transaction | A small network fee | An entry worth nothing | Yes |
| Dust | Fractions of a cent plus the fee | A tiny entry with a real value | No |
Trezor Suite, the creator's own wallet app, blurs zero-value entries in the transaction list so they do not sit there looking like something you can copy. Dust transfers stay visible because their value is above zero.
The creator does not pretend this closes the hole. A scammer willing to pay dust can get past the blur, and the creator said that is more expensive, so it is less common when an attacker is planting entries for hundreds or thousands of addresses at once. I read the feature as one layer of friction rather than a solution, since the habit it guards against is still yours to keep.
One thing to hold while you read the recommendation: the creator sells hardware wallets, so the advice to buy one comes from an interested party. That does not make the advice wrong, and you can check the blurring rule for zero-value entries in the app yourself. The parts you cannot check that way deserve a second look.
Why Ethereum and Solana see more of it
The creator names Ethereum and Solana as two of the networks where address poisoning is most common, and gives a technical reason: some cryptocurrencies let a wallet send a zero-value transaction without actually having access to that wallet. If a network allows that, an attacker does not need your keys to put an entry next to your address. They only need your address.
That has a consequence people miss. Poisoned history is not only about payments you receive. The creator warned that a transaction history can hold both incoming and outgoing entries, so a row that looks like something you sent to a contact is not proof that you ever sent it. Treat the list as a record of what the network accepted, not of what you did.
For anyone holding assets on either chain, a strange entry is a reason to slow down and fetch the address from somewhere else, even when the entry matches the one you were about to use.
How to protect yourself from address poisoning
None of the protection depends on spotting the fake before you copy it. It depends on never copying from the list in the first place, plus a check that takes a few seconds. These are the steps in the order the creator lays them out.
- Open the source of the address and copy it there. For an exchange withdrawal, that means the withdrawal page. For a payment to a person, ask them to send the address again. Do not reuse a saved entry from your history.
- Apply the same rule to your own addresses. When you move funds from a centralized exchange to a hardware wallet, the receiving address comes from the wallet, not from an old transaction.
- Read every character before you confirm. Compare the string in chunks, from left to right, and do it twice when the amount is large.
- Confirm the address on the hardware wallet's own screen. It shows the receiving address on its display and asks you to approve it on the device, so malware on a computer cannot quietly swap one address for another.
- Keep the rule wherever you are. Copying from a history list is an unnecessary risk in a wallet app and in a block explorer alike.
- Accept what you cannot control. You cannot stop someone sending a transaction to your public address, just as you cannot stop mail arriving at your home. What you control is whether you act on it.
A block explorer, for anyone who has not used one, is a website that shows what a network has recorded: transactions, addresses, balances. It is useful for checking that a payment landed, and it is also a place where the same lookalike entries can appear, which is why the creator puts it under the same rule.
The creator's summary is one line: "The only way to ensure safety is to check each character of an address." That sounds tedious until you weigh it against a single mistaken paste, where the loss is whatever happened to be in the wallet at the time.
The test transaction trap
Sending a small amount first is a common habit, and the creator is fine with the test itself. The trap is what people do next.
Say you send a tiny payment to a new address to check that it works. The transfer lands, and the entry is now in your history. The creator said the moment a scam address enters your history is right after a test transaction like that, because a bot inserts it there. Go back to the list for the real payment and the newest entry may belong to the attacker, matching the address you just tested closely enough to pass a glance.
The fix is easy to state and easy to forget: send the test, confirm it arrived, then return to the original source for the real address. Do not copy the tested address out of the list, and do not assume a successful test proves the entry you are looking at is the one you used.
This is the part of the scam I find sharpest. The habit that feels most careful, sending a small amount first, is exactly the moment the poisoned entry appears.
What to check before your next transfer
Keep the source open while you fill in the send form. If you use a hardware wallet, read the address on its screen, because that is the address the device will sign for.
Treat an unexpected entry as information. A row that matches the address you use and that you do not recognise is what this scam looks like from the victim's side. Ignore it. There is nothing to delete and nobody to reply to.
Keep the scale in mind. In the creator's example, the planted transaction is worth 0.000001 ETH. A number that small buys an attacker a place in your list, and a place in your list is all they need. Reading one long string of characters before you press send is the whole defence, and it holds whether or not a wallet's blurring feature catches the attempt.
