An address poisoning attack is a cryptocurrency scam where attackers send negligible or zero-value transactions from a spoofed address to pollute a user wallet transaction history. Attackers design these vanity addresses to share identical starting and ending characters with the target legitimate contacts, betting that the user will copy and paste the destination address from their recent activity feed during future transfers.
How Address Poisoning Works and Why Copying History Fails
Blockchain addresses are long hexadecimal strings, leading many wallet interfaces and users to truncate the middle characters for visual brevity. Fraudsters exploit this user habit through automated tools:
- Vanity Address Generation: Attackers deploy vanity generators to create public addresses matching the first and last four to six characters of a victim frequent counterparty.
- History Infiltration: The attacker broadcasts a dust transfer or zero-token smart contract transfer directly into the victim wallet feed.
- Unintended Selection: When initiating a subsequent payment, the sender copies the poisoned entry from recent wallet activity rather than validating the full cryptographic string or using an address book.
Because blockchain transactions are immutable, funds routed to a poisoned address cannot be reversed or recovered by wallet providers or node validators.
Address Poisoning vs Clipboard Hijacking
While both tactics manipulate the destination address during fund transfers, their mechanisms differ entirely. Clipboard hijacking requires malware installed on a local device to silently overwrite copied strings in the system clipboard. Address poisoning operates entirely on-chain without compromising the user hardware, private keys, or wallet software. Safeguards against poisoning rely on disciplined operational procedures, such as maintaining verified wallet address books and systematically checking the full character string before signing any transaction broadcast.