Address Poisoning: How Zero-Value Transfers Set Up Wallet Drains

Address poisoning requires no malware, no stolen keys, and no smart contract exploit. It works against a habit: you copy the recipient address from your transaction history or an explorer, compare the first and last few characters, and hit send. An attacker seeds that history with a lookalike address, waits for the day you copy the wrong one, and receives your transfer instead. In 2026 it remains one of the highest-yield low-effort attacks in crypto — here is exactly how it works and the habits that neutralize it.

The mechanics, step by step

1. The attacker generates a vanity lookalike. Using vanity-address generators, they create an address matching your real recipient’s first and last 4–6 characters (e.g. 0x3fA9...c42E). Cheap GPU time is the only cost — matching 6 characters on both ends can take minutes to hours.
2. They poison your history. From a fresh wallet, they send you a zero-value transfer of a real token (or a dust amount). On most explorers and wallet apps this incoming transfer displays exactly like a normal interaction — same token, plausible timestamp, 0 amount easily missed.
3. They wait. The poisoned entry now sits in your “recent interactions.” Nothing else happens. The attack costs the attacker gas plus generation time, and they can run it against thousands of addresses in parallel.
4. You complete it. Weeks later you want to send funds to your exchange deposit address. You open history, copy the familiar-looking 0x3fA9...c42E, verify first and last chars against memory, send. The attacker receives it. Transfers on networks without easy reversal are final.

Why it works: address-truncation UIs (0x3fA9…c42E) are a usability compromise that attackers turned into an attack surface. Your eye checks the visible fragments; the middle — where the fake diverges — is invisible.

The variants worth knowing

Zero-value transfers are the dominant vector because they’re nearly free and land in history exactly like real activity. Dust variants add plausibility on explorers that filter zero amounts.

Who is at risk

• High-frequency senders — merchants, OTC desks, active traders making repeated transfers to the same counterparties. Habit is the vulnerability.
• Withdrawal-flows users — anyone repeatedly sending to exchange deposit addresses, which are publicly linked to exchange hot wallets and trivially identifiable for poisoning.
• Team wallets — payroll and treasury operations where multiple people copy addresses from shared history.

Prediction-market traders sit squarely in the risk zone: repeated deposits/withdrawals between exchanges and Polygon funding wallets are exactly the pattern poisoning feeds on — and the USDT/pUSD funding flow makes deposit addresses public in every trade.

The defenses that actually work

1. Full-address verification, once. When you first use a recipient, store it in a labeled address book (hardware wallet contact, password manager). Verify every character once, carefully.
2. Never copy from transaction history. This single habit change defeats the attack completely. History is attacker-writable; your address book isn’t.
3. Use wallet address books / ENS. Send to exchangename.eth or a saved contact, not a pasted string. The UI then shows you the label, and a mismatch is unmissable.
4. Test transactions for new/large transfers. Send 1% first, verify receipt at the intended recipient on the receiving side (login to the exchange — don’t check the sending wallet’s history).
5. Treat zero-value transfers as noise. Seeing a 0-amount transfer from an unknown address isn’t a compromise — ignore it, don’t interact, and definitely don’t “cancel” it (interaction is what scammers hope for; there is no cancel).
6. Hardware-wallet full-address display. On the device, the full address is shown. Cross-check the middle characters, not just the ends.

What address poisoning is NOT

• It is not access to your funds. A poisoned history entry can’t steal anything by itself.
• It is not a sign your wallet is compromised. Delete nothing, sign nothing, and carry on.
• It becomes a loss only when you later send funds to the poisoned address. The attack’s entire payload is your next copy-paste.

That’s also why it pairs so often with drainer flows: a poisoned address gets your transfer once, while approval-based drainers take everything. Different mechanisms, same reliance on rushed signing and unverified recipients.

If you already sent to a poisoned address

Funds sent to an attacker’s address are gone in practice — transfers are final. Two recovery-adjacent moves are legitimate: report the address to the receiving exchange if the attacker later consolidates there (exchanges occasionally freeze tagged funds), and preserve the tx hash for any law-enforcement report. Anything offering to “reverse” the transfer for a fee is a recovery scam.

FAQ

What is address poisoning in crypto? An attack where scammers send zero-value or dust transfers from a lookalike address so it appears in your history, betting you’ll copy it for a future transfer.

How do attackers make addresses with the same start and end? Vanity generators brute-force keypairs until the address matches chosen prefix/suffix characters. Matching 4–6 characters on both ends is cheap.

Can a zero-value transfer steal my funds? No. It’s a display-level trap. Loss happens only if you later send funds to the attacker’s lookalike address.

How do I safely store frequent recipient addresses? Address books in hardware wallets, password managers, or ENS names — verified once, character by character, then reused by label, never by copying from history.

Should I worry about the zero-value transfers I keep receiving? No — mark as noise and ignore. They can’t take anything; interacting with the sender is the only mistake available.

Educational content, not financial advice. Last updated October 2026.