What is address poisoning, and how does it trick people into paying the wrong address?

Why addresses are easy to fake

An Ethereum-style address is a 40-character string of hexadecimal digits (0 to 9 and a to f). Researchers at Carnegie Mellon University note that such strings are hard to remember, so people often pick addresses from their recent transaction history. That habit is what address poisoning exploits.²

Many screens shorten addresses. The same researchers say most wallet apps used to show only the first and last 3 to 5 characters.² Etherscan, a block explorer, says attackers use "vanity" address generators to make an address that matches a real one's first and last few characters.¹

How the history gets poisoned

Etherscan describes address poisoning as creating fake transactions in a victim's history, to trick them into sending funds to the attacker's address.¹ The researchers found three ways to do it.²

• Tiny transfers. The look-alike address sends you a very small amount of a token you use, so it shows up in your history.²
• Zero-value transfers. A transfer of zero tokens that appears to go from you to the look-alike. The researchers say this may be even more dangerous, because it looks as if you have paid that address before.²
• Fake tokens. The attacker makes a token whose name looks like a popular one, such as USDT, and uses it to fake a transfer from you.^2,1

How can a stranger make a transfer that seems to come from you? The ERC-20 standard says transfers of zero must be treated as normal transfers.⁵ Revoke.cash explains that a zero-value transferFrom always succeeds, even with no approval, because zero is not more than the zero allowance.³ No tokens move and your keys are safe, but the entry appears in your history.⁶

Etherscan says attackers watch for large transfers, often of stablecoins, and have planted fakes within a minute of the real one.¹

How big is it?

The Carnegie Mellon team watched Ethereum and Binance Smart Chain (BSC) from July 2022 to June 2024.² They found 270 million poisoning attempts aimed at 17 million victims. 6,633 of them worked, costing victims at least $83.8 million.²

Most attempts fail, so why bother? Etherscan's answer: one large payment sent to the wrong address is enough to cover the attackers' costs.¹

Compare the whole address

Revoke.cash says the common advice to check the first and last 4 characters is not enough.³ ethereum.org says the address you send to should exactly match the one you mean.⁴ A payment sent on Ethereum can't be reversed.⁴

Longer matches cost attackers more. The researchers say each extra matching character makes a look-alike 16 times harder to find.² Etherscan's January 2024 guide says it now shows more characters at each end for this reason.¹

What the guides suggest

• Don't copy from history. Revoke.cash says never to treat your wallet history or a block explorer as the source of an address. Copy an exchange's deposit address from its website each time.³
• Use a saved list. Etherscan suggests a wallet's contact list or allowlist feature for addresses you use often.¹
• Know what a muted transfer means. Etherscan's guides say it hides zero-value transfers by default and marks them with a grey warning icon. They say your wallet and keys are still safe.^6,1