# Ethereum Address Poisoning: Look-Alike Address Scams Explained

Source: https://www.ethvanity.com/blog/ethereum-address-poisoning

Published: 2026-11-02

Updated: 2026-11-09

![A pattern is not an identity. Look-alike: A familiar prefix can be copied by an attacker; History: An unsolicited transfer is not a trusted contact; Check: Compare the full destination with a trusted source.](https://www.ethvanity.com/images/blog/ethereum-address-poisoning-diagram-v2.webp)

A pattern is not an identity. Look-alike: A familiar prefix can be copied by an attacker; History: An unsolicited transfer is not a trusted contact; Check: Compare the full destination with a trusted source.

[Full-size diagram (SVG)](https://www.ethvanity.com/images/blog/ethereum-address-poisoning-diagram-v2.svg)

[Diagram download (PNG)](https://www.ethvanity.com/images/blog/ethereum-address-poisoning-diagram-v2.png)

Address poisoning is a scam where an attacker mines a look-alike address that shares the first and last characters of one you use, then plants it in your transaction history with a zero-value, dust or fake-token transfer. If you later copy the address from history, you pay the attacker. A 2025 USENIX Security study measured at least $83.8 million in losses on Ethereum and BNB Smart Chain.

## How an address poisoning attack works

The attack exploits a habit: most people check only the first and last few characters of a 42-character address, and many wallets display addresses shortened to something like 0x3f5C...9e21. An attacker watches the chain for a victim sending funds to a counterparty, then generates an address with the same visible characters and makes it appear in the victim's history right next to the real one.

Generating the look-alike is a vanity address search. Matching the first 4 and last 4 hex characters means fixing 8 characters, which needs 16^8, about 4.29 billion, attempts on average; the math is the same as in the [vanity difficulty guide](https://www.ethvanity.com/blog/ethereum-vanity-address-difficulty). The USENIX Security 2025 paper by Tsuchiya, Dong, Soska and Christin identified a large attacker group that appears to use GPUs for this generation.

- Step 1: the victim sends tokens to a legitimate address, for example an exchange deposit address.
- Step 2: the attacker mines an address matching that address's leading and trailing characters.
- Step 3: the attacker creates a transfer between the victim and the look-alike, so it shows in the victim's history.
- Step 4: the victim later copies the most recent-looking entry from history and sends funds to the attacker.

## Zero-value, dust and fake-token transfers

The study and Etherscan's summary describe three ways to plant the look-alike. Each one makes a record appear in your history without needing your signature.


| Technique | How it works | What you see |
| --- | --- | --- |
| Zero-value transfer | Calls transferFrom on a real token for an amount of 0, which many tokens allow without an allowance | A 0 USDT transfer from your address to the look-alike |
| Dust transfer | Sends a tiny real amount of ETH or a token from the look-alike to you | A small incoming payment from a familiar-looking address |
| Fake token | Deploys a token with a real token's name and symbol and emits fake transfer events | A transfer of a token named USDT that is not the real contract |


## How big the problem is

The USENIX Security 2025 paper Blockchain Address Poisoning scanned two years of Ethereum and BNB Smart Chain data, from July 2022 to June 2024, and found 6,633 incidents causing at least $83.8 million in losses. Etherscan's March 2026 summary of the study lists about 17.4 million poison transfers on Ethereum targeting about 1.3 million addresses, with at least $79.3 million lost on Ethereum alone.

Individual attempts rarely work. Etherscan cites a success rate of about 0.01% per poisoning attempt on Ethereum, roughly 1 in 10,000, but attackers compensate with volume because a single large mistaken transfer pays for thousands of failed attempts. The paper also found that competing attacker groups often target the same victim at the same time.

The economics are simple. A poison transfer costs the attacker only a transaction fee, and generating a 4-plus-4 character look-alike costs about 4.29 billion hash attempts, so a single victim who repeats a large stablecoin payment to the wrong address can fund many thousands of attempts. Anyone who regularly sends large amounts to the same counterparty and copies the address from history fits the profile the attack depends on.


## Why checksums and vanity patterns do not protect you

A look-alike address is a real address with a valid EIP-55 checksum, so checksum validation passes. The checksum only catches accidental typos, as explained in [hex characters and EIP-55](https://www.ethvanity.com/blog/ethereum-vanity-address-hex-checksum).

Owning a vanity address does not help either and can make things worse. An address like 0x0000...beef trains you and your counterparties to check only the memorable part, and the attacker only has to match the same characters you are looking at. Every additional character you verify multiplies the attacker's work by 16, so checking 10 characters at each end instead of 4 raises the expected effort from 16^8 to 16^20.

Wallet display choices matter here. Interfaces that truncate addresses to 6 or 8 visible characters reduce the attacker's cost to matching only those characters, while interfaces that show the full string or highlight differences make look-alikes far easier to spot. When your wallet allows it, expand the full address on the confirmation screen and compare it against your address book entry rather than against your memory.


## Spotting a poisoned entry in your history

Poisoned records follow recognizable patterns. The illustrative pair below, shortened on purpose, shows how a legitimate address and a look-alike can share the same first 4 and last 4 characters while differing everywhere in between.

- A transfer of 0 tokens that you did not initiate but that appears as outgoing from your address.
- A tiny incoming amount from an address that looks like one of your regular counterparties, shortly after you paid them.
- A token with a familiar symbol whose contract address does not match the official one listed by the issuer.
- An entry flagged by your explorer with a poisoning or spoofed-token label, or hidden behind a filter for zero-value transfers.

```sh
legit : 0x3f5C 41b2...c88d 9e21   (your exchange deposit)
poison: 0x3f5C d07a...12fe 9e21   (attacker look-alike)
          ^^^^ same          ^^^^ same
# illustrative only - not real addresses
```


## How to defend against address poisoning

The reliable defenses all remove the step of copying an address from transaction history.

- Save known counterparties in your wallet's address book or contacts and pick them from there, never from recent activity.
- Verify the full address, all 40 characters, before signing, or at least compare long segments at the start, middle and end against an independent source.
- Use ENS names for recurring recipients where your wallet resolves them, and confirm the name resolves to the expected address; the trade-offs are in [vanity address vs ENS](https://www.ethvanity.com/blog/ethereum-vanity-address-vs-ens).
- Pay attention to explorer and wallet warnings. Etherscan labels known poisoning addresses, hides zero-value token transfers by default, tags spoofed tokens and highlights similar-looking addresses.
- Send a small test transaction to a new address and confirm receipt out of band before sending a large amount.
- Ignore unexpected zero-value or dust transfers; they cannot take funds from you, so there is nothing to do except not reuse the address.

## Extra precautions if you publish a vanity address

Publishing a recognizable address, for example for donations or a project treasury, invites look-alikes because attackers know exactly which characters people will check. Publish the full checksummed address in a place you control, link it to an ENS name, and tell supporters to verify the complete string or the name rather than the vanity part.

If you send to your own vanity address from another wallet, save it in that wallet's address book once, after verifying it character by character, and always select it from there. Attackers poison both directions: they target the sender's history as well as the recipient's.


## Explore the related mechanism

- [Ethereum Vanity Address Format: Hex Characters and EIP-55 Checksum](https://www.ethvanity.com/blog/ethereum-vanity-address-hex-checksum) — Which characters an Ethereum vanity address can use, how the EIP-55 checksum works, and why case-sensitive patterns need more attempts.
- [Ethereum Vanity Address vs ENS Name: Which Should You Use?](https://www.ethvanity.com/blog/ethereum-vanity-address-vs-ens) — Compare an Ethereum vanity address with an ENS name: cost, renewal, security, wallet support and when to use both together.
- [Open the complete workflow guide](https://www.ethvanity.com/guide) to place these checks in order.
- [Open the address generator](https://www.ethvanity.com/) when you have chosen a compatible format and pattern.

## Frequently asked questions

### Can a zero-value transfer steal my tokens?

No. A zero-value transferFrom moves nothing and needs no approval from you. Its only purpose is to put a look-alike address into your history so you copy it later.

### Should I interact with the poisoning transaction to remove it?

No. You cannot delete on-chain history, and interacting with unknown tokens or contracts can expose you to other scams. Simply never copy addresses from history.

### How long does it take to create a look-alike address?

Matching 4 leading and 4 trailing hex characters needs about 4.29 billion attempts on average, which GPU tools can do quickly. Each extra matched character multiplies the work by 16.

### Do hardware wallets prevent address poisoning?

They help only if you verify the full address on the device screen. A hardware wallet will faithfully sign a transfer to a look-alike if that is the address you entered.

### What should I do if I already sent funds to a poisoned address?

Transactions cannot be reversed. Report the address quickly to the exchange or service it sends funds to, and to the issuer if the asset is a centrally issued stablecoin, since some issuers can freeze addresses. File a police report for any recovery effort.

## Sources

- [USENIX Security 2025: Blockchain Address Poisoning (Tsuchiya et al.)](https://www.usenix.org/conference/usenixsecurity25/presentation/tsuchiya)

- [arXiv:2501.16681: Blockchain Address Poisoning](https://arxiv.org/abs/2501.16681)

- [Etherscan: Address poisoning attacks are rising on Ethereum](https://info.etherscan.com/address-poisoning-attacks-are-rising-on-ethereum)



Editorial method: https://www.ethvanity.com/about#publication-method