What are address poisoning attacks in crypto and how to avoid them?

Key takeaways

Address poisoning involves sending small transactions from wallet addresses that closely resemble a legitimate one, tricking users into copying the wrong address when making future transactions.

Common techniques include phishing, fake QR codes, Sybil attacks, smart contract manipulation, and clipboard malware.

Address poisoning has led to over $83 million in confirmed losses. Victims include individual users and DeFi platforms.

Users should rotate addresses, use hardware or multisig wallets, whitelist trusted contacts, and leverage blockchain analytics.

Address poisoning attacks in crypto are scams where attackers trick users into sending funds to a fake address that looks almost identical to a legitimate one. These attacks exploit wallet address similarity, address reuse, or malware to mislead users into unintentionally transferring assets to the wrong party.

While the blockchain itself is secure, address poisoning targets human error and trust — often through clever deception or technical manipulation.

This article will explain what address poisoning attacks are, their types and consequences, and how to protect oneself against such attacks.

Address poisoning attacks in crypto, explained

In the world of cryptocurrencies, hostile actions where attackers influence or deceive consumers by tampering with cryptocurrency addresses are referred to as address poisoning attacks.

On a blockchain network, these addresses, which are made up of distinct alphanumeric strings, serve as the source or destination of transactions. These attacks use a variety of methods to undermine the integrity and security of cryptographic wallets and transactions.

Address poisoning attacks in the crypto space are mostly used to either illegally acquire digital assets or impair the smooth operation of blockchain networks. These attacks may encompass:

Theft: Attackers may trick users into transmitting their funds to malicious addresses using strategies such as phishing, transaction interception or address manipulation.

Disruption: Address poisoning can be used to disrupt the normal operations of blockchain networks by introducing congestion, delays or interruptions in transactions and smart contracts, reducing the effectiveness of the network.

Deception: Attackers frequently attempt to mislead cryptocurrency users by posing as well-known figures. This undermines community trust in the network and might result in erroneous transactions or confusion among users.

To protect digital assets and the general integrity of blockchain technology, address poisoning attacks highlight the significance of strict security procedures and constant attention within the cryptocurrency ecosystem.

Related: How to mitigate the security risks associated with crypto payments

Types of address poisoning attacks

Address poisoning attacks in crypto include phishing, transaction interception, address reuse exploitation, Sybil attacks, fake QR codes, address spoofing and smart contract vulnerabilities, each posing unique risks to users’ assets and network integrity.

Phishing attacks

In the cryptocurrency realm, phishing attacks are a prevalent type of address poisoning, which involves criminal actors building phony websites, emails or communications that closely resemble reputable companies like cryptocurrency exchanges or wallet providers.

These fraudulent platforms try to trick unsuspecting users into disclosing their login information, private keys or mnemonic phrases (recovery/seed phrases). Once gained, attackers can carry out unlawful transactions and get unauthorized access to victims’ Bitcoin (BTC) assets, for example.

For instance, hackers might build a fake exchange website that looks exactly like the real thing and ask consumers to log in. Once they do so, the attackers can gain access to customer funds on the actual exchange, which would result in substantial financial losses.

Transaction interception

Another method of address poisoning is transaction interception, in which attackers intercept valid cryptocurrency transactions and change the destination address. Funds destined for the genuine receiver are diverted by changing the recipient address to one under the attacker’s control. This kind of attack frequently involves malware compromising a user’s device or network or both.

Address reuse exploitation

Attackers monitor the blockchain for instances of address repetition before using such occurrences to their advantage. Reusing addresses can be risky for security because it might reveal the address’s transaction history and vulnerabilities. These weaknesses are used by malicious actors to access user wallets and steal funds.

For instance, if a user consistently gets funds from the same Ethereum address, an attacker might notice this pattern and take advantage of a flaw in the user’s wallet software to access the user’s funds without authorization.

Sybil attacks

To exert disproportionate control over a cryptocurrency network’s functioning, Sybil attacks entail the creation of several false identities or nodes. With this control, attackers are able to modify data, trick users, and maybe jeopardize the security of the network.

Attackers may use a large number of fraudulent nodes in the context of proof-of-stake (PoS) blockchain networks to significantly affect the consensus mechanism, giving them the ability to modify transactions and potentially double-spend cryptocurrencies.

Fake QR codes or payment addresses

Address poisoning can also happen when fake payment addresses or QR codes are distributed. Attackers often deliver these bogus codes in physical form to unwary users in an effort to trick them into sending cryptocurrency to a location they did not plan.

For example, a hacker might disseminate QR codes for cryptocurrency wallets that look real but actually include minor changes to the encoded address. Users who scan these codes unintentionally send money to the attacker’s address rather than that of the intended receiver, which causes financial losses.

Address spoofing

Attackers who use address spoofing create cryptocurrency addresses that closely resemble real ones. The idea is to trick users into transferring money to the attacker’s address rather than the one belonging to the intended recipient. The visual resemblance between the fake address and the real one is used in this method of address poisoning.

An attacker might, for instance, create a Bitcoin address that closely mimics the donation address of a reputable charity. Unaware donors may unintentionally transfer money to the attacker’s address while sending donations to the organization, diverting the funds from their intended use.

Smart contract vulnerabilities

Attackers take advantage of flaws or vulnerabilities in decentralized applications (DApps) or smart contracts on blockchain systems to carry out address poisoning. Attackers can reroute money or cause the contract to behave inadvertently by fiddling with how transactions are carried out. Users may suffer money losses as a result, and decentralized finance (DeFi) services may experience disruptions.

Did you know? Chainalysis uncovered over 82,000 wallets linked to a widespread campaign specifically targeting users with high crypto balances, underscoring how dangerous and far-reaching these scams can be.

Real-world examples of address poisoning attacks

Here are some examples of address poisoning attacks in crypto:

$2.6 million USDT loss (May 2025): In May 2025, a crypto trader lost $2.6 million in two back-to-back address poisoning scams using a technique called zero-value transfers. This advanced phishing method exploits how token transfers appear in a user’s transaction history, tricking victims into trusting spoofed addresses. Zero-value transfers don't require private key signatures, making them stealthy and effective. Over 270 million such attempts have occurred across Ethereum and BNB Chain, with $83 million in confirmed losses, highlighting a growing cross-chain threat.

EOS blockchain attack (March 2025): Following its rebranding to Vaulta, the EOS blockchain experienced an address poisoning attack. Malicious actors sent small amounts of EOS from addresses mimicking major exchanges like Binance and OKX, aiming to trick users into sending funds to fraudulent addresses. This attack exploited the similarity in address names to deceive users.

$68M loss in WBTC (May 2024): An unknown trader lost $68 million in Wrapped Bitcoin (WBTC) in a single address-poisoning scam. The attacker tricked the victim’s wallet into sending 1,155 WBTC to a spoofed address that closely resembled a legitimate one. The incident, flagged by Cyvers, wiped out over 97% of the victim’s holdings, highlighting the high stakes of address-based scams.

Did you know? Trugard and Webacy have launched an AI-powered tool to detect crypto wallet address poisoning. The system uses supervised machine learning trained on real and synthetic transaction data, achieving a 97% detection rate.

Consequences of address poisoning attacks

Address poisoning attacks can have devastating effects on both individual users and the stability of blockchain networks. Because attackers may steal crypto holdings or alter transactions to reroute money to their own wallets, these assaults frequently cause large financial losses for their victims.

Beyond monetary losses, these attacks may also result in a decline in confidence among cryptocurrency users. Users’ trust in the security and dependability of blockchain networks and related services may be damaged if they fall for fraudulent schemes or have their valuables stolen.

Additionally, some address poisoning assaults, such as Sybil attacks or the abuse of smart contract flaws, can prevent blockchain networks from operating normally, leading to delays, congestion or unforeseen consequences that have an effect on the entire ecosystem. These effects highlight the need for strong security controls and user awareness in the crypto ecosystem to reduce the risks of address poisoning attacks.

Related: How to put words into a Bitcoin address? Here’s how vanity addresses work

How to avoid address poisoning attacks

To protect users’ digital assets and keep blockchain networks secure, it is crucial to avoid address poisoning assaults in the cryptocurrency world.

The following ways may help prevent being a target of such attacks: