Address poisoning: why you should never copy an address from your transaction history
Attackers send you dust from an address that looks like one you use, hoping you copy theirs next time.
Updated 2026-10-12
Checklist · 3 steps
- Never copy a recipient address from your history. Use a saved address book or scan a QR code.
- Check the first six and last six characters of every address, every time.
- Send a small test amount before any large transfer to a new address.
You send to an address often, so the attacker generates a vanity address with the same first and last characters and sends you a tiny amount from it. It appears in your history next to the real one. The next time you copy from history, there is a chance you copy theirs.
This has drained individual wallets of tens of millions of dollars in single transactions. It works because wallets truncate addresses in the middle and people check the ends.
⚿