What are address poisoning attacks in crypto and how to avoid them?

Key takeaways

• Address poisoning involves sending small transactions from wallet addresses that closely resemble a legitimate one, tricking users into copying the wrong address when making future transactions. 

• Common techniques include phishing, fake QR codes, Sybil attacks, smart contract manipulation, and clipboard malware. 

• Address poisoning has led to over $83 million in confirmed losses. Victims include individual users and DeFi platforms.

• Users should rotate addresses, use hardware or multisig wallets, whitelist trusted contacts, and leverage blockchain analytics. 

Address poisoning attacks in crypto are scams where attackers trick users into sending funds to a fake address that looks almost identical to a legitimate one. These attacks exploit wallet address similarity, address reuse, or malware to mislead users into unintentionally transferring assets to the wrong party.

While the blockchain itself is secure, address poisoning targets human error and trust — often through clever deception or technical manipulation.

This article will explain what address poisoning attacks are, their types and consequences, and how to protect oneself against such attacks.

Address poisoning attacks in crypto, explained

In the world of cryptocurrencies, hostile actions where attackers influence or deceive consumers by tampering with cryptocurrency addresses are referred to as address poisoning attacks.

On a blockchain network, these addresses, which are made up of distinct alphanumeric strings, serve as the source or destination of transactions. These attacks use a variety of methods to undermine the integrity and security of cryptographic wallets and transactions.

Address poisoning attacks in the crypto space are mostly used to either illegally acquire digital assets or impair the smooth operation of blockchain networks. These attacks may encompass:

• Theft: Attackers may trick users into transmitting their funds to malicious addresses using strategies such as phishing, transaction interception or address manipulation.

• Disruption: Address poisoning can be used to disrupt the normal operations of blockchain networks by introducing congestion, delays or interruptions in transactions and smart contracts, reducing the effectiveness of the network.

• Deception: Attackers frequently attempt to mislead cryptocurrency users by posing as well-known figures. This undermines community trust in the network and might result in erroneous transactions or confusion among users.

To protect digital assets and the general integrity of blockchain technology, address poisoning attacks highlight the significance of strict security procedures and constant attention within the cryptocurrency ecosystem.

Related: How to mitigate the security risks associated with crypto payments

Types of address poisoning attacks

Address poisoning attacks in crypto include phishing, transaction interception, address reuse exploitation, Sybil attacks, fake QR codes, address spoofing and smart contract vulnerabilities, each posing unique risks to users’ assets and network integrity.

Phishing attacks

In the cryptocurrency realm, phishing attacks are a prevalent type of address poisoning, which involves criminal actors building phony websites, emails or communications that closely resemble reputable companies like cryptocurrency exchanges or wallet providers.

These fraudulent platforms try to trick unsuspecting users into disclosing their login information, private keys or mnemonic phrases (recovery/seed phrases). Once gained, attackers can carry out unlawful transactions and get unauthorized access to victims’ Bitcoin (BTC) assets, for example.

For instance, hackers might build a fake exchange website that looks exactly like the real thing and ask consumers to log in. Once they do so, the attackers can gain access to customer funds on the actual exchange, which would result in substantial financial losses.

Transaction interception

Another method of address poisoning is transaction interception, in which attackers intercept valid cryptocurrency transactions and change the destination address. Funds destined for the genuine receiver are diverted by changing the recipient address to one under the attacker’s control. This kind of attack frequently involves malware compromising a user’s device or network or both.

Address reuse exploitation

Attackers monitor the blockchain for instances of address repetition before using such occurrences to their advantage. Reusing addresses can be risky for security because it might reveal the address’s transaction history and vulnerabilities. These weaknesses are used by malicious actors to access user wallets and steal funds.

For instance, if a user consistently gets funds from the same Ethereum address, an attacker might notice this pattern and take advantage of a flaw in the user’s wallet software to access the user’s funds without authorization.

Sybil attacks

To exert disproportionate control over a cryptocurrency network’s functioning, Sybil attacks entail the creation of several false identities or nodes. With this control, attackers are able to modify data, trick users, and maybe jeopardize the security of the network.

Attackers may use a large number of fraudulent nodes in the context of proof-of-stake (PoS) blockchain networks to significantly affect the consensus mechanism, giving them the ability to modify transactions and potentially double-spend cryptocurrencies.

Fake QR codes or payment addresses

Address poisoning can also happen when fake payment addresses or QR codes are distributed. Attackers often deliver these bogus codes in physical form to unwary users in an effort to trick them into sending cryptocurrency to a location they did not plan.

For example, a hacker might disseminate QR codes for cryptocurrency wallets that look real but actually include minor changes to the encoded address. Users who scan these codes unintentionally send money to the attacker’s address rather than that of the intended receiver, which causes financial losses.

Address spoofing

Attackers who use address spoofing create cryptocurrency addresses that closely resemble real ones. The idea is to trick users into transferring money to the attacker’s address rather than the one belonging to the intended recipient. The visual resemblance between the fake address and the real one is used in this method of address poisoning.

An attacker might, for instance, create a Bitcoin address that closely mimics the donation address of a reputable charity. Unaware donors may unintentionally transfer money to the attacker’s address while sending donations to the organization, diverting the funds from their intended use.

Smart contract vulnerabilities

Attackers take advantage of flaws or vulnerabilities in decentralized applications (DApps) or smart contracts on blockchain systems to carry out address poisoning. Attackers can reroute money or cause the contract to behave inadvertently by fiddling with how transactions are carried out. Users may suffer money losses as a result, and decentralized finance (DeFi) services may experience disruptions.

Did you know? Chainalysis uncovered over 82,000 wallets linked to a widespread campaign specifically targeting users with high crypto balances, underscoring how dangerous and far-reaching these scams can be.

Real-world examples of address poisoning attacks

Here are some examples of address poisoning attacks in crypto:

• $2.6 million USDT loss (May 2025): In May 2025, a crypto trader lost $2.6 million in two back-to-back address poisoning scams using a technique called zero-value transfers. This advanced phishing method exploits how token transfers appear in a user’s transaction history, tricking victims into trusting spoofed addresses. Zero-value transfers don’t require private key signatures, making them stealthy and effective. Over 270 million such attempts have occurred across Ethereum and BNB Chain, with $83 million in confirmed losses, highlighting a growing cross-chain threat.

• EOS blockchain attack (March 2025): Following its rebranding to Vaulta, the EOS blockchain experienced an address poisoning attack. Malicious actors sent small amounts of EOS from addresses mimicking major exchanges like Binance and OKX, aiming to trick users into sending funds to fraudulent addresses. This attack exploited the similarity in address names to deceive users.

• $68M loss in WBTC (May 2024): An unknown trader lost $68 million in Wrapped Bitcoin (WBTC) in a single address-poisoning scam. The attacker tricked the victim’s wallet into sending 1,155 WBTC to a spoofed address that closely resembled a legitimate one. The incident, flagged by Cyvers, wiped out over 97% of the victim’s holdings, highlighting the high stakes of address-based scams.

Did you know? Trugard and Webacy have launched an AI-powered tool to detect crypto wallet address poisoning. The system uses supervised machine learning trained on real and synthetic transaction data, achieving a 97% detection rate. 

Consequences of address poisoning attacks

Address poisoning attacks can have devastating effects on both individual users and the stability of blockchain networks. Because attackers may steal crypto holdings or alter transactions to reroute money to their own wallets, these assaults frequently cause large financial losses for their victims.

Beyond monetary losses, these attacks may also result in a decline in confidence among cryptocurrency users. Users’ trust in the security and dependability of blockchain networks and related services may be damaged if they fall for fraudulent schemes or have their valuables stolen.

Additionally, some address poisoning assaults, such as Sybil attacks or the abuse of smart contract flaws, can prevent blockchain networks from operating normally, leading to delays, congestion or unforeseen consequences that have an effect on the entire ecosystem. These effects highlight the need for strong security controls and user awareness in the crypto ecosystem to reduce the risks of address poisoning attacks.

Related: How to put words into a Bitcoin address? Here’s how vanity addresses work

How to avoid address poisoning attacks

To protect users’ digital assets and keep blockchain networks secure, it is crucial to avoid address poisoning assaults in the cryptocurrency world. 

The following ways may help prevent being a target of such attacks:

• Use fresh addresses: Using a new crypto wallet address for each transaction reduces the risk of attackers linking addresses to a user’s identity or transaction history. Hierarchical deterministic (HD) wallets help prevent address poisoning by automatically generating a fresh address every time, making it harder for attackers to manipulate or mimic previous transactions and redirect funds.

• Utilize hardware wallets: When compared to software wallets, hardware wallets are a more secure alternative. They minimize exposure by keeping private keys offline.

• Exercise caution when disclosing public addresses: People should exercise caution when disclosing their crypto addresses in the public sphere, especially on social media sites, and should opt for using pseudonyms.

• Choose reputable wallets: It is important to use well-known wallet providers that are known for their security features and regular software updates to protect oneself from address poisoning and other attacks.

• Regular updates: To stay protected against address poisoning attacks, it is essential to update the wallet software consistently with the newest security fixes.

• Implement whitelisting: Use whitelisting to limit transactions to reputable sources. Some wallets or services allow users to whitelist particular addresses that can send funds to their wallets.

• Consider multisig wallets: Wallets that require multiple private keys to approve a transaction are known as multisignature (multisig) wallets. These wallets can provide an additional degree of protection by requiring multiple signatures to approve a transaction.

• Utilize blockchain analysis tools: Blockchain analysis tools help detect address poisoning by identifying dusting patterns — small, seemingly insignificant crypto transfers (UTXOs) sent to multiple wallets. These tiny transactions can signal malicious attempts to poison address histories and trick users.

• Report suspected attacks: If an address poisoning attack is suspected, individuals should immediately contact their crypto wallet provider via official support channels and report the incident in detail. They should also notify relevant law enforcement or regulatory bodies, especially if significant financial loss or malicious intent is involved. Prompt reporting helps mitigate risks and protect the broader crypto community.