A new scam has already stolen $1.6 million from crypto users, and it works by exploiting something almost everyone does without thinking: copying and pasting a wallet address.
How address poisoning actually works
Here’s the mechanism. A scammer looks at your past transaction history and creates a new wallet address that shares the same first four and last four characters as an address you’ve actually sent crypto to before. They then send you a zero-dollar transaction from that fake address, which gets recorded in your wallet’s transaction history right alongside your real contacts.
The next time you go to send crypto, you might scroll back through your history, see an address that looks right at a glance since the first four and last four characters match, copy it, and send your funds straight to the scammer instead of your intended recipient. Nothing about the transaction looks unusual until the money is already gone.
The scale of the problem
Since December, more than 340,000 addresses have been poisoned this way, and scammers have stolen roughly $1.6 million from 95 wallets using this exact technique. That’s a meaningful number of victims for a scam most crypto users have never heard of, which is exactly why it keeps working.
How to protect yourself
- Never trust an address just because it matches the first and last few characters you remember. Check the full string.
- Use a saved address book or verified contact list inside your wallet instead of copying from transaction history.
- Treat any zero-dollar or unexpected incoming transaction as a red flag, not a curiosity.
- When sending a meaningful amount, send a small test transaction first and confirm it arrived before sending the rest.
Address poisoning works because it targets a habit, not a technical vulnerability. There’s no bug to patch and no software update that fixes it. The fix is entirely behavioral: slow down before you copy an address, and verify the full string every time, especially when you’re sending a transaction you can’t reverse.
Educational only, not tax, legal, or investment advice. Check primary sources and speak with a qualified professional before making financial decisions.
