A cryptocurrency wallet can show a transaction that looks familiar even when the address belongs to a scammer. This is the danger of crypto address poisoning: attackers place misleading wallet addresses in your transaction history, hoping you will copy one when making your next payment.
New wallet protections are making these scams easier to detect. In June 2026, MetaMask introduced automatic warnings for suspicious lookalike addresses. However, a warning system cannot establish that every unflagged recipient is trustworthy.
The safest approach is to obtain the recipient’s address from a verified source, check the complete address before approving the transfer, and never treat transaction history as an address book.
How Criminals Poison a Crypto Wallet’s Transaction History
Most cryptocurrency addresses contain long strings of letters and numbers. Wallet applications often shorten these strings, displaying only a few characters at the beginning and end.
Attackers exploit this design.
Imagine that you regularly send cryptocurrency to a particular wallet. A scammer can observe your transactions on a public blockchain and generate another address with a similar beginning and ending.
The scammer then arranges for the fake address to appear in your transaction history. This can happen through a tiny incoming payment, a zero-value token transfer, or another misleading token record.
Later, you open your wallet to make another payment. You recognize what appears to be your usual recipient, copy the address, and authorize the transfer.
The blockchain processes the payment according to your instructions. Unfortunately, the destination belongs to the attacker.
Coinbase’s security researchers documented this mechanism in their technical analysis of zero-transfer phishing, published on February 14, 2023. They explained how certain token implementations allowed attackers to create zero-value transfer records involving another wallet without obtaining its private key.
That distinction matters.
A suspicious zero-value transfer does not automatically mean someone has stolen your recovery phrase or accessed your wallet. The immediate danger is that the misleading transaction may influence a future payment.
A confirmed transfer also cannot establish whether you intended to pay that recipient.
Research Shows Why Attempt Counts Are Not the Same as Losses
Address poisoning is more than an isolated phishing technique.
A Carnegie Mellon University research team examined Ethereum and BNB Smart Chain activity between July 1, 2022, and June 30, 2024.
Their research on blockchain address poisoning identified approximately:
- 270 million poisoning attempts.
- 17 million targeted wallet addresses.
- 6,633 successful fraudulent transfers.
- $83.8 million in associated losses.
The study was published as an arXiv preprint in January 2025 and subsequently appeared at the 2025 USENIX Security Symposium. These findings describe the researchers’ historical observation period, not the total losses recorded during 2026.
The difference between attempts and successful thefts is important.
An attacker might send thousands of misleading transactions without receiving any meaningful funds. Each attempt can appear in blockchain data, but that does not mean each target suffered a financial loss.
The study also found that attackers favored wallets with larger balances and substantial transaction activity. Some operations used automated systems to create similar addresses and distribute misleading transactions.
This helps explain why address poisoning is difficult to eliminate through user education alone. Criminals can repeat attempts at scale while waiting for a relatively small number of mistakes.
What MetaMask’s 2026 Address-Poisoning Protection Actually Does
On June 17, 2026, MetaMask announced a new detection feature designed to identify suspicious destination addresses before users submit transactions.
According to MetaMask’s official announcement, the protection compares a pasted destination address against addresses previously used by the wallet.
If the destination closely resembles an earlier recipient but differs in other characters, MetaMask displays a warning.
The wallet also warns users when they attempt to send cryptocurrency to an address with which they have never previously interacted.
MetaMask said the feature was available in its mobile application and browser extension across Ethereum Virtual Machine-compatible networks. These are blockchain networks that use Ethereum-compatible technology.
The improvement addresses two problems.
First, it attempts to identify potentially deceptive addresses before a transfer occurs.
Second, MetaMask now displays more characters from addresses in its sending interface, making differences easier to notice.
However, these protections have limits.
A warning identifies a potential risk; it does not independently establish who owns the address. Users can also proceed after receiving a warning.
The announced protection should not be assumed to cover every blockchain, wallet application, attack variation, or software version.
Most importantly, the absence of a warning is not proof that a payment destination is legitimate.
Address Poisoning Is Different From Clipboard Malware
Not every cryptocurrency address attack starts with a misleading transaction history.
Another threat involves clipboard malware.
This malicious software monitors information copied on a device. When it detects a cryptocurrency address, it may replace that address with one controlled by an attacker.
As explained in MetaMask’s guidance on clipboard hacking, a user may copy a legitimate address but unknowingly paste a different one.
That creates a separate problem.
Address poisoning relies primarily on manipulating which recipient a person chooses. Clipboard malware changes information during the copying and pasting process.
Some malicious programs may only activate under specific conditions, making them difficult to identify through simple tests.
A hardware wallet can provide an additional opportunity to inspect the recipient on a separate device display. However, this safeguard only helps when the user actually compares the displayed address against a trusted source.
It cannot protect someone who knowingly approves the wrong destination.
There is also a third category of risk: malicious transaction approvals.
These attacks can involve granting a smart contract permission to spend tokens or signing a message that authorizes an unwanted action. They are different from accidentally choosing a poisoned payment address.
Our existing guide to crypto wallet permissions explains how connections, spending approvals, and signatures create different security responsibilities.
A Safer Method for Sending Cryptocurrency
Avoiding address poisoning does not require memorizing complicated addresses. It requires a reliable method for verifying where a payment will go.
1. Obtain the address directly from its intended source
When transferring cryptocurrency to an exchange, open the exchange through its verified website or official application.
Find the current deposit instructions for the specific asset and network.
Do not copy the destination from an old transaction simply because it worked previously.
For person-to-person payments, obtain the address through a trusted communication channel and independently confirm significant changes.
2. Compare the complete recipient address
Before sending, compare the address shown in your wallet against the address supplied by the intended recipient.
Checking only the first and last four characters is insufficient. Address-poisoning attacks are specifically designed to exploit this habit.
Pay particular attention to the characters normally hidden when an address is shortened.
When using a hardware wallet, compare its displayed destination with the verified address rather than relying exclusively on the computer screen.
3. Verify the cryptocurrency and network
An address comparison is only part of the process.
Make sure the sending and receiving services support the same cryptocurrency on the selected blockchain.
Where required, confirm additional information such as a destination tag or memo.
A correct-looking address on an unsupported network can still produce an unsuccessful or inaccessible deposit.
4. Save verified recipients carefully
For regular payments, a wallet’s address book or an approved recipient list can reduce dependence on transaction history.
Only save an address after verifying it.
If a recipient changes its address, treat the replacement as a new destination requiring confirmation.
Never assume a familiar label proves that the saved information remains current.
5. Consider a small test transfer
For a large transfer, a small test payment can confirm that the selected destination can receive funds on the intended network.
However, a test transaction is not an identity check.
If you accidentally test an attacker’s address, the test may succeed because that address is operational.
Verify the intended recipient first. A test transfer provides another checkpoint, not a replacement for destination verification.
It may also incur network fees or other service charges.
What to Do After Finding a Suspicious Transaction
Finding an unfamiliar zero-value transfer or tiny incoming payment is not, by itself, evidence that your wallet has been compromised.
Do not immediately move everything to another address, connect to an unfamiliar cleanup service, or follow links attached to suspicious tokens.
Instead, stop using the questionable transaction as a recipient reference.
Check its details through a reputable blockchain explorer and compare the address against your independently verified records.
Our blockchain explorer guide explains how to find transaction hashes, inspect transfers, and distinguish transaction records from wallet balances.
Remember that an explorer can show what happened on a blockchain without proving that a displayed counterparty is someone you trust.
If you already sent funds to an unintended address, preserve the transaction hash, destination address, network, amount, and relevant correspondence.
Contact the sending platform and any relevant receiving service through independently verified support channels. Where appropriate, report suspected fraud to the relevant authorities.
Confirmed blockchain transfers generally cannot be canceled by the sender. Recovery may sometimes be possible through third-party cooperation or investigations, but it is not guaranteed.
Avoid anyone who promises to recover cryptocurrency in exchange for another payment, wallet connection, or recovery phrase.
The Most Important Change Is How You Choose a Recipient
Modern wallet warnings are useful because they can catch certain mistakes before funds leave an account.
But address poisoning demonstrates a broader problem: a genuine blockchain record can contain information deliberately created to deceive the person reading it.
The practical solution is to separate transaction history from recipient verification.
Use history to investigate payments. Use independently verified recipient information to authorize new ones.
That habit remains valuable whether a wallet has advanced fraud detection, basic security warnings, or no automatic address-poisoning protection.
