Imagine paying someone you know, only to discover you copied a stranger’s wallet address. That’s the trick behind a crypto address-poisoning scam.
The scammer doesn’t necessarily hack your wallet. Instead, they try to make the wrong address look familiar enough that you paste it into your next transfer.
How does it happen?
Crypto wallet addresses are long strings of letters and numbers. Many apps shorten them on screen, showing just the first and last few characters.
A scammer can create a different address that looks similar when shortened. They may send you a tiny amount of crypto so their address shows up in your transaction history. Later, you might copy that address, thinking it’s one you’ve used before.
That single copy-and-paste mistake could send your money to the scammer.
A simple example
You regularly pay a friend. Their address starts with 0x1234 and ends with abcd. An unfamiliar address in your history appears to start and end the same way. But the characters in the middle are different. The two addresses are not the same.
How to avoid the trap
- Get the address from the person or business you’re paying, not from a random entry in your history.
- Check the full address carefully before sending. Matching only the first and last few characters isn’t enough.
- Make sure you’ve selected the right blockchain and token.
- For a large transfer, consider sending a small test amount first. Still check the full address again afterward.
- Use a trusted address book if your wallet offers one, and verify entries before saving them.
Does a surprise deposit mean someone hacked me?
Not necessarily. Someone can send crypto to a public wallet address without controlling it. The danger here is being tricked into sending money back or copying the wrong address.
What if I’ve sent funds to the wrong address?
Blockchain transfers usually cannot be undone. Save the transaction details and contact the receiving service if you can identify one. Don’t trust anyone who promises guaranteed recovery in exchange for payment.
For help checking where a transaction went, read how to use a blockchain explorer.
Quick questions
Can address poisoning empty my wallet by itself?
No. This particular trick relies on you sending funds to the wrong place. Other scams may involve separate malicious permissions.
Is a small test payment enough?
It can help, but it isn’t a substitute for checking the full destination address.
Further reading: MetaMask security advice.
