--- content_id: 23 content_type: evergreen-answer priority: P1 intent: safety cluster: security-scams language: en title: "What Is Address Poisoning and How Can It Trick Crypto Wallet Users?" slug: address-poisoning-crypto-wallet-users canonical: https://wallet.terenval.com/answers/address-poisoning-crypto-wallet-users/ primary_query: "what is crypto address poisoning" last_reviewed: 2026-10-05 publisher: Terenval --- # What Is Address Poisoning and How Can It Trick Crypto Wallet Users? ## Direct answer Address poisoning is a scam in which an attacker creates an address that resembles one you previously used and causes that lookalike address to appear in your transaction history, often through a tiny or zero-value transfer. The attacker hopes you will later copy the poisoned address from history and send funds to it. The defense is to obtain the destination from a trusted source and verify the full or sufficiently distinctive address, not just the first and last few characters. ## Key takeaways - The scam does not need to compromise your private key. - A lookalike address can be engineered to share visible prefix/suffix characters. - The poisoned transaction itself may be harmless; the loss happens when you later copy the wrong destination. - Recent transaction history is not an address book. - A small test transfer helps only if you verify the destination independently. ## How the attack works After observing a public transaction, an attacker generates a vanity address visually similar to the real recipient. Because wallet UIs often shorten addresses to something like `0x1234…ABCD`, matching the visible edges can make the attacker address look familiar. The attacker then sends a tiny/zero-value transaction involving the lookalike address so it appears in your activity. Later, if you copy that address from history instead of obtaining the recipient address from a trusted source, the transfer goes to the attacker. ## Why checking only the first and last characters can fail Shortened address displays are useful for readability but create a recognition shortcut. A targeted vanity address can deliberately match those visible characters while differing in the middle. For meaningful transfers, expand the address when possible and compare more of it. If the recipient is an exchange, use the current deposit address displayed by the exchange rather than an old transaction. For a personal contact or your own second wallet, use a verified address book/QR workflow. ## Safe recipient-verification workflow 1. Obtain the address directly from the intended recipient or current receive screen. 2. Confirm the network separately. 3. Paste the address and compare it against the trusted source. 4. Do not choose a destination solely because it appears in recent history. 5. For a large transfer, send a small test and verify receipt. 6. Re-check the final destination before the larger transfer. If a wallet warns that an address closely resembles a previous address but differs in the middle, stop and verify instead of dismissing the warning. ## Address poisoning vs clipboard hijacking Address poisoning manipulates your transaction history and your recognition habits. Clipboard hijacking uses malware on the device to replace the address you copied. Both can end with a payment to the attacker, but the attack surfaces differ. The shared defense is independent destination verification before signing. ## Common mistakes - Copying the most recent address from history. - Verifying only four characters at each end for a high-value transfer. - Assuming an incoming tiny transaction identifies a legitimate contact. - Believing the wallet can infer your intended human recipient with certainty. - Reusing an exchange deposit address without checking whether it is still current and supported. ## How this works in Terenval Wallet When sending from Terenval Wallet, treat the transaction review screen as the final checkpoint: verify the selected network, recipient and amount against a trusted source. Network safeguards can detect some chain mismatches, but no wallet can reliably know whether a lookalike address is the human recipient you intended. Do not source a destination from suspicious recent activity. Use the recipient's current receive address and a test transfer for large or unfamiliar routes. ## Frequently asked questions ### Can address poisoning steal my seed phrase? The basic attack does not need your seed phrase. It tries to make you authorize a valid transfer to the wrong address. ### Is a zero-value incoming transaction dangerous by itself? Usually the danger is social/operational: it pollutes history. Do not interact with unknown tokens or links attached to suspicious activity. ### Can I recover crypto sent to a poisoned address? Confirmed blockchain transfers are generally irreversible without cooperation from the recipient. Prevention and address verification are therefore critical. ## Sources - https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/ - https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/ - https://ethereum.org/developers/docs/accounts ## Editorial review Published by Terenval. Technical review: Terenval Wallet team. Last reviewed: 2026-10-05. ## Related Terenval Answers - [What Is Clipboard Hijacking in Crypto and How Do You Prevent It?](https://wallet.terenval.com/answers/clipboard-hijacking-crypto-prevention/) - [How Can You Tell a Fake Crypto Wallet App from a Real One?](https://wallet.terenval.com/answers/how-to-tell-fake-crypto-wallet-app-from-real/) - [How Do Token Approval Scams Drain Crypto Wallets?](https://wallet.terenval.com/answers/token-approval-scams-drain-wallets/) - [How Do Fake Crypto Wallet Support Scams Work?](https://wallet.terenval.com/answers/fake-crypto-wallet-support-scams/) Editorial policy: https://wallet.terenval.com/editorial-policy/ Official article: https://wallet.terenval.com/answers/address-poisoning-crypto-wallet-users/