Address poisoning: the copy-paste crypto scam and how to stop it

A look-alike address is useless if it never reaches you. So the attacker pushes it into your transaction history. The simplest way is a tiny transfer of a real token such as USDC or USDT sent from the fake address to yours, hoping you later copy that spoofed address by mistake ^[1]. Because the amount is trivial, you may never notice it arrive.

A second route uses a zero-value transfer. Attackers call the transferFrom function with a value of zero, and since every address defaults to zero approval, the Transfer event is still emitted and shows up in your history ^[1]. This is how a record of a payment you never made ends up looking like part of your normal activity.

Timing makes it sharper. Attackers watch the chain for frequent or large stablecoin transfers and create spoofed events as soon as one minute after the real one ^[1]. Imagine you pay someone, then need to pay again two minutes later. You assume the newest address in your history is right and copy it, and the money goes to the attacker ^[1]. Cheaper network use may be adding to the noise: Coin Metrics found that 38% of stablecoin balance updates on Ethereum between November 2025 and January 2026 were under a single penny, consistent with millions of wallets receiving tiny poisoning deposits ^[4].

The attack only pays off at one instant: when you go to send and reach for your history instead of your contacts. You open a past transaction, tap the address, paste it into the send box, and confirm. Nothing looks wrong because the start and end match. The transaction is final, and a transaction sent on Ethereum is irreversible ^[2].

Because one big mistake is enough to cover the attacker's costs, the attack keeps coming back ^[1]. The reported losses show why. One victim lost $12.2 million in January by copying the wrong address from their transaction history, following a similar $50 million loss in December ^[4]. In an earlier case, a victim mistakenly sent $20 million to a spoofed address whose first and last characters closely matched the real one ^[1].

Smaller cases add up too. A spoofed transfer shown inside a wallet interface led one victim to copy the wrong receiver and lose about $1.45 million ^[1]. Web3 Antivirus tracked some of the largest address-poisoning losses over time, ranging from $4 million to $126 million, and said recent incidents show the trend is not slowing ^[4]. These are not careless beginners. They are people moving real money who trusted a screen that showed them a familiar-looking string.

Address poisoning often travels with two helpers. The first is token spoofing. Attackers deploy token contracts with a name and symbol that copy a well-known token, so a fake USDT can sit beside the real one ^[1]. Because ERC-20 contracts can share the same name and symbol, you cannot rely on those fields for security ^[3].

The second helper is event spoofing. A contract decides what its own Transfer events say, so a scammer can write one that shows a transfer from a respected address or an airdrop from a known name ^[1][3]. Legitimate-looking owners and legitimate-looking transfers can both be faked, since the balances and events live in the scammer's contract ^[3].

The point is that your history is not a trusted record. It is a list of events that anyone can try to write into, and some interfaces blend real and fake transactions in one tab ^[1]. Etherscan responds by hiding zero-value transfers by default and hiding transfers of tokens with poor reputation, and it shows a reminder when you copy an address from a transfer with warning signs ^[1]. A good wallet should do the same kind of filtering for you, so decoys never get the chance to sit there waiting.

The first habit is simple: never treat your history as an address book. Save the people you pay as contacts, and send to the saved entry. Etherscan's own advice for this scam is to use a wallet's contact list or allowlist feature, and to tag frequent addresses with meaningful names ^[1]. A saved contact cannot be swapped for a look-alike by a stranger's dust.

The second habit is to check the whole address, not the ends. Ethereum.org says to make sure the address you send to exactly matches the intended recipient before sending ^[2]. When the amount is large, send a small test first and confirm it arrived. A tiny test costs little, and it turns a possible total loss into a minor one.

The third habit is to cut the noise. Hide zero-value and low-reputation transfers where your tools allow it, and treat any unexpected small deposit as bait rather than a gift ^[1]. Browser tools can help too: Revoke.cash added address poisoning detection to its paid extension tier ^[5]. For a longer look at limits that catch mistakes before money leaves, see our piece on spending limits and allowlists, and for general self-custody habits, our guide to self-custody.

SpendTheBits is a fully non-custodial wallet, so the checks below happen on your phone and the keys never leave it. The design target is the two moments the scam relies on: the decoy arriving, and you copying it. For the first, tiny inbound transfers from a look-alike of an address you already paid are hidden from Activity and never trigger a notification, so they cannot sit in your history waiting to be copied.

For the second, the Send screen speaks up before a payment goes out. It warns in plain words when an address looks almost identical to one you have paid or saved, which is the address-poisoning case. It also warns when it is the first time you are sending to that address, and when a first payment to a new address is large, it suggests a small test send first. Every recipient is also risk-screened before the send.

Related protections sit nearby. Unknown inbound tokens are quarantined so a fake token cannot pose as a real balance, and a request that would grant a contract unlimited spending approval is flagged before signing. Your saved contacts and a clear read of the fake token and scam transfer help page round it out. No tool removes the need to look, but these warnings put the right question in front of you at the right second. You can also set spending guardrails for an extra layer.