What is address poisoning?

Address poisoning is a scam in which an attacker sends tiny transfers from wallet addresses engineered to resemble ones you already deal with, so the fake address sits in your transaction history. Later, when you copy an address from that history instead of from its true source, funds go to the scammer — and cannot be recalled.

L4 News publishes information, not investment advice, and nothing here is a reason to buy or move any crypto asset. The habit changes described below are about accuracy in copying, not about any particular asset or platform.

How does an address poisoning attack actually work?

The attacker watches your public history, generates addresses that share the first and last characters of an address you transact with, and sends you dust from them. Your wallet's history now shows a near-twin of your real counterparty. Months later you copy that twin into a withdrawal — the transfer completes instantly, to them.

The attack has three moving parts, and all of them are cheap. First, blockchains are public: anyone can watch an address and see who sends it money. Second, generating an address with a chosen prefix or suffix is a solved computational task — 'vanity' address generation grinds through candidates until one matches, and a handful of characters takes hours, not centuries. Third, sending a near-zero transfer costs the attacker a small fee and costs you nothing until the trap closes.

The FBI's Internet Crime Complaint Center described this pattern in a public advisory in 2023, noting that victims typically copy the fraudulent address from their own transaction history. The advisory is worth reading in full at ic3.gov; the mechanics below follow it.

Why doesn't checking the first and last characters work?

Because the attacker matched exactly those. Software can grind through candidate addresses until one repeats your prefix and suffix — a few characters is hours, not years. A check that looks only where the scammer prepared is a check the scammer wrote. Verify positions they can't predict, or skip copying altogether.

The first-and-last habit made sense once: random typos corrupt the middle of a pasted string less visibly than the ends, and legacy checksums flag some errors. But it collides with the economics of vanity generation. Matching four characters at each end is trivial; matching the middle would require reproducing the entire address, which is the same as being the address.

So the defense isn't a better pattern of spot checks — it's not sourcing addresses from your history at all. The history is the attack surface. Every address you copy from it is an address someone else chose the neighbors for.

How do I verify a receiving address correctly?

Copy it fresh from the live source — the recipient's wallet, a verified QR code, or an address-book entry you saved after double-checking — not from your own history. Send a small test amount and confirm arrival before the real transfer. On a hardware wallet, compare the address on the device screen, not the browser.

Beyond that rule, a few habits cover the remaining gaps.

• Spot-check the middle. If you must eyeball an address, compare characters in the middle — positions six through ten, say — along with the ends. Look-alikes are built to match the ends because that's what people check.
• Keep an address book. Save each counterparty once, after verifying from the live source, and send only to saved entries. The verification work happens once, deliberately, instead of every time, hurriedly.
• Treat human-readable names with the same suspicion. Blockchain domain names like 'name.eth' look safer than hex strings, but look-alike registrations exist there too — a doubled letter in a familiar name is just as easy to miss.
• Test-send on large transfers. A small test costs one fee and confirms the whole chain: the copied address, the network, and the recipient's setup.

What do poisoned transfers look like in the wild?

Usually boring, which is the point. A transfer of a fraction of a token, or even a zero-value transfer on chains that support them, appears from an address that starts and ends like your exchange deposit address, your regular counterparty, or your own second wallet. Some wallets display such entries faintly or hide zero-value events; others show them like any other transfer.

The timing is deliberately patient. The poison may sit in your history for weeks before you make a routine withdrawal and reach for the 'recent' address. By the time the mistake is visible, the transaction has dozens of confirmations and no undo.

Can I get the money back if I sent it to a poisoned address?

No. A confirmed on-chain transfer to an address you don't control is final; there is no support desk that reverses it. What remains is reporting — the FBI's IC3 accepts complaints at ic3.gov — and hygiene: treat the fake address as burned, and warn others who transact with you.

'Final' deserves its plain meaning. Exchanges sometimes freeze funds that arrive at their own deposit addresses during an investigation, but a scammer's self-custodied wallet is not an exchange. Anyone promising to reverse or 'chase' the transaction for a fee is running the follow-up scam that feeds on victims of the first one.

Is my privacy at risk from all this watching?

It already was, poison or no poison. Public chains let anyone observe balances and counterparties; the scam simply weaponizes that openness by adding fake entries to the record. The same visibility that lets block explorers verify your outbound transfer lets an attacker study your habits — which is exactly how they knew which address to impersonate.

The practical conclusion isn't paranoia; it's routing. People who move meaningful amounts often keep separate addresses for different purposes, so the history of any single address says less. That is a privacy decision with its own costs and is worth making deliberately, not fearfully.

Recap in one line: the chain is public, your history is editable by strangers in this one narrow way, and the fix is refusing to treat history as an address book.