Address poisoning: why history is not a contact list
How lookalike addresses get planted in your transaction history, why copying from that list is risky, and a slow-down check before you send. Literacy only—not a recommendation to use any wallet, explorer, or asset.
Wallets and explorers often shorten addresses (first few characters, last few characters). Humans copy from “the last time I sent there.” Address poisoning exploits both habits. Public materials from MetaMask Help, Etherscan’s information center, and ethereum.org security pages describe the same pattern: a tiny or zero-value transfer from a lookalike address so it shows up in your history.
What the attacker does
- They watch a public transfer you already made (your address, or a counterparty you used).
- They generate a vanity address whose start and end match that real address, while the middle is different.
- They send you a dust, spoofed-token, or zero-value transfer from that lookalike. Receiving it does not, by itself, move your funds—but it poisons the history.
Later, if you tap the most recent similar-looking row and paste that address as the destination, the send goes to them. Confirmed chain transfers are generally not reversible (ethereum.org: sending to the wrong address is a common, often unrecoverable mistake).
Why the UI makes it easy to miss
- Truncation: if the screen shows only the first four and last four characters, two addresses can look identical.
- Recency bias: poison transfers are often sent minutes after a real one, so they sit at the top of activity lists (Etherscan has described high-volume, automated campaigns).
- Clipboard haste: copying from history or from a chat bubble is faster than checking a saved contact.
A slow-down check before you send
- Do not treat transaction history as an address book. Prefer a contact you saved after verifying the full string once.
- Compare middle characters, not only the ends. Hardware-wallet screens that show the full destination are useful when the device supports clear display.
- If you must recover an address, open a known-good past transaction on a public explorer you navigated to yourself, not a screenshot or a random “support” link.
- A first-time send to an address you have never used is a reason to pause—not proof it is malicious, and not a reason to rush.
- Some wallets now warn on lookalikes or first-time destinations. A warning is a prompt to re-read the string, not a guarantee.
Related free docs
- Common crypto scams to recognize
- How to read a blockchain transaction
- Hot wallet hygiene checklist
- Address-book & send-test worksheets (teaser) — overview only; no payment link on this page
Sources
- MetaMask Help — Address poisoning scams (vendor education; not an endorsement)
- Etherscan Information Center — Address poisoning attacks
- ethereum.org — Security and scam prevention
- ethereum.org — Scam help & reporting
- FTC — What to know about cryptocurrency and scams
Educational content only — not investment advice. This page explains a documented abuse pattern; it does not recommend any wallet vendor, token, or trade.