Cryptocurrency offers new opportunities for investing and managing money, but it also comes with risks that can catch even careful users off guard. Enter address poisoning, a clever scam that’s becoming more common in the crypto ecosystem.

Address poisoning is a scheme that plays on how we handle crypto transactions. Imagine your crypto wallet address as a long bank account number with a string of letters and numbers unique to you. Scammers create a fake address that looks almost identical to one you’ve used before, hoping you’ll accidentally copy the wrong one and send them your money.

How and Why Address Poisoning Happens

Address poisoning works by exploiting a simple habit: many people copy and paste addresses from their transaction history. Scammers monitor the blockchain, watching public transaction records to find active wallets and the addresses you often send to, like an exchange or a friend’s wallet. The scammer creates a “lookalike” address that matches the first and last few characters of your actual address.

The “poisoning” step occurs when the scammer sends a tiny amount of crypto (called “dust”) from this fake address to your wallet. This makes the fake address appear in your transaction history.

When you go to send funds later, you might glance at your history, copy the wrong address without checking every character, and transfer your money straight to the scammer. It’s low-risk and potentially high-reward for the scammer. 

Creating these addresses costs little, especially on blockchains with cheap fees. They can target thousands of wallets at once using automated scripts. Once you send funds to their address, the money is gone. This scam preys on oversight, making it especially dangerous for anyone who doesn’t double-check on the details.

How Common Is Address Poisoning?

In 2025 and early 2026, over 65 million poisoning transactions across blockchains were tracked—about 160,000 per day. Of those, around 316,000 led to actual losses, meaning roughly 1 in 200 attempts succeeded.

Losses add up quickly. On Ethereum alone, experts report over a million poisoning attempts daily. High-profile cases include a trader losing $50 million in December 2025 and another $12.25 million in January 2026, so the losses are significant.

Government agencies have noted the rise in crypto scams, including those involving deceptive addresses. The FBI’s Internet Crime Complaint Center (IC3) has warned about token impersonation scams that tie into address poisoning, where fake tokens mimic real ones to enhance the deception.

Red Flags and What to Look Out For

The good news is you can spot address poisoning before it costs you. Here are they key red flags:

Unexpected small transfers: If you receive a tiny amount of crypto from an unknown address that looks similar to yours or one you use often, that’s a classic sign. Ignore it—don’t interact.

Mismatched addresses in history: Always compare the full address, not just the start and end. Wallets often shorten them (e.g., “0x123…abc”), so expand to check every character.

Suspicious timing: These dust transactions often follow right after you make a real transfer, as scammers monitor the blockchain in real-time.

To protect yourself:

Use address whitelisting: Many wallets and exchanges, like those from Coinbase or Kraken, let you save trusted addresses. Stick to these and avoid copying from history.

Verify twice: Before sending, paste the address into a note app and compare it side-by-side with the intended one. Or send a small test amount first.

Hardware wallets: Devices like Ledger keep keys offline, reducing risks, and often require physical confirmation for transactions.

Enable security features: Exchanges like Crypto.com recommend using two-factor authentication (2FA) and monitoring for unusual activity.

What You Should Do If You Identify a Poisoned Address

If you notice a suspicious address in your wallet:

Don’t send anything to it: That’s exactly what the scammer wants. Mark it as spam in your wallet app if possible.

Secure your wallet: Change passwords, enable 2FA if not already, and consider moving funds to a new wallet address.

Report it: File a complaint with the FBI’s IC3 at ic3.gov so law enforcement can track these scams and can help prevent others. If you’ve lost money, contact your local FBI field office.

Notify your exchange: Platforms often advise reporting suspicious activity immediately for investigation.