# Wallet Address Poisoning Scam: How It Works and What to Check > Learn how a wallet address poisoning scam plants a lookalike address in your history, what it does not compromise, and what to verify before sending. Published: 2025-08-01 | Updated: 2026-11-04 | Author: MRHB Team Canonical: https://mrhb.network/blogs/wallet-address-poisoning-scam/ See also: https://mrhb.network/llms.txt --- > **Important:** This guide is educational. Crypto transfers may be irreversible. Never share a private key or recovery phrase with anyone offering support, investigation or recovery. ## Quick answer A **wallet address poisoning scam** places a lookalike address in your transaction history. The attacker hopes you will later copy that address by mistake and send crypto to them. The unexpected transaction does **not normally reveal your private key or drain your wallet by itself**. The danger comes later: you copy the wrong destination, approve the transfer, and the blockchain processes the instruction you signed. If you see an unfamiliar tiny or zero-value entry, do not interact with it or use its address. Get the correct address from the intended recipient or another independently verified original source, compare the full address, check the network, and review the details again before signing. ## How does address poisoning work? Many blockchain addresses are long strings of letters and numbers. Wallets and block explorers often shorten them to show only the beginning and end. Attackers exploit this display habit: 1. They observe public blockchain activity and identify an address that a user has sent to or received from. 2. They create a different address that resembles the expected address, often at the beginning and end. 3. They send a tiny, zero-value or imitation-token transaction so the lookalike appears in the user's history. 4. They wait for the user to copy that entry during a later transfer. 5. If the user signs a transfer to the lookalike, the funds go to the attacker. The [MetaMask Help Center](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/) describes this as an attack on copy-and-paste habits. The history entry is bait; the attack succeeds only if the wrong address is used later. ### A fictional example Imagine Sam regularly pays a supplier. The wallet history shortens the supplier's address to something like: `AB12...7XYZ` An attacker creates a different address that the interface also shortens to: `AB12...7XYZ` The hidden middle is different. If Sam checks only the visible beginning and end, the two may appear identical. These are abstract labels, not real addresses. The lesson is to compare the complete destination from a trusted source—not to memorise a few characters. ## What does the suspicious transaction mean? An unknown entry can be unsettling, but it is important not to assume more than the evidence shows. In a typical address-poisoning attempt: - the attacker has not learned your private key; - the attacker has not gained permission to sign from your wallet; - the planted entry does not need you to “clean” or return it; and - simply seeing the entry does not mean your wallet has been drained. Public blockchains allow other people to see addresses and transaction activity. On some networks, strangers can also send tokens or create history entries without the recipient's approval. Do not interact with an unknown token, link or contract to investigate it. A suspicious entry may be simple poisoning, or it may be connected to a different scam. Use the wallet provider's official support channel if the interface gives a warning you do not understand. ## How to verify an address before sending Use the same routine every time, even when the recipient looks familiar. ### 1. Start from the original source Ask the intended recipient for the address through an agreed channel, use a verified deposit page, or open the official receiving wallet directly. Do not treat transaction history, a block explorer entry, a search ad or an unsolicited message as the original source. ### 2. Confirm the network and asset The same-looking asset may exist on several networks. Confirm which network the recipient supports and whether a memo, tag or other identifier is required. ### 3. Compare the complete address Check more than the first and last characters. Use the wallet's full-address view, copy the source again if needed, and compare the complete value in a clean environment. ### 4. Treat address books as verified records, not automatic truth An address book can reduce repeated copying, but only after the entry has been checked independently. Protect changes to saved contacts, and re-verify after a recipient changes wallet, network or account. ### 5. Use the device checkpoint when available If a hardware wallet or signing device shows the destination, compare that display with the independently sourced address before approving. A device cannot tell you whether the person behind an address is honest; it helps you check what you are signing. The [hot wallet versus cold wallet guide](https://mrhb.network/blogs/hot-wallet-vs-cold-wallet/) explains how an offline signer changes online exposure without removing the need to inspect each transaction. ### 6. Consider a small test transfer A small test can catch some wrong-address, wrong-network or setup errors. Wait until the intended recipient confirms receipt before considering another transfer. A test has limits. It may cost an extra network fee, minimum-transfer rules may apply, and a correct test does not prove that a later address copied from history is correct. Verify every transfer again. ### 7. Read the final signing screen Check the destination, network, asset, amount, fee and any contract permission. Stop if the details differ from what you intended or if the interface pressures you to act quickly. ## What should you do when you spot a poisoned entry? 1. **Do not send anything back.** An unknown entry does not create a debt or support request. 2. **Do not copy its address.** Get the legitimate destination from its original verified source. 3. **Do not click token names, links or notes.** Unknown assets can be part of other scams. 4. **Use the wallet's hide, flag or report feature when available.** Follow official product instructions. 5. **Review recent outgoing transactions.** Confirm that no transfer was sent to the lookalike. 6. **Warn the intended recipient or team.** Share the transaction hash, not a private key or recovery phrase. 7. **Strengthen the process.** Verify saved contacts, hardware displays and staff procedures before the next transfer. You usually do not need to move all assets merely because an unknown transaction appeared. Moving assets in a panic can create another opportunity for error. If you also see an unauthorised outgoing transaction, unexpected approval or other sign of compromise, treat that as a separate and more serious incident and contact the wallet provider's official support. ## What if you already sent to the wrong address? Act quickly, but do not trust anyone who promises guaranteed recovery. - Save the transaction hash, destination, network, time and any related messages. - Confirm the transaction status using an official or reputable block explorer for that network. - Contact the sending wallet, exchange or service through its official support page. - If the destination belongs to a known exchange or service, that provider may have a process for reports, but recovery is not guaranteed. - Report fraud to the appropriate platform and local authority where relevant. - Watch for follow-on “recovery” scams. Never pay an unknown person or reveal a recovery phrase to get funds back. A confirmed blockchain transfer generally cannot be cancelled by the wallet interface. Only the controller of the receiving address or a relevant custodial provider may be able to return or freeze funds, and often they cannot. ## Address poisoning is not the same as every wallet scam | Threat | What happens | Main check | |---|---|---| | Address poisoning | A lookalike address is planted in history. | Use the original source and compare the full destination. | | Clipboard malware | Malware replaces an address after it is copied. | Compare the final pasted address and signing-device display. | | Phishing | A fake site or person asks for secrets or a harmful signature. | Use official channels; never share a recovery phrase. | | Malicious token approval | A signed permission lets a contract move supported assets. | Read the approval, limit permissions and revoke unused access. | | Recovery-phrase compromise | Someone obtains the secret backup and can recreate the wallet. | Move to a newly secured setup using official incident guidance; never reuse the exposed phrase. | These threats can overlap. A full address check helps with poisoning and clipboard replacement, but it does not make a malicious contract safe or repair an exposed recovery phrase. ## A team checklist for repeated payments Businesses, charities and families making regular transfers need a process that does not depend on one person's memory. - Keep an approved recipient record with owner, network, address, date verified and verification method. - Require a second person to verify a new or changed destination for higher-impact transfers. - Confirm changes through a channel already known to belong to the recipient. - Do not accept address changes sent only in a new email thread or direct message. - Use clear labels for saved contacts and review who can edit them. - Record the transaction hash and recipient confirmation. - Pause when a familiar address suddenly changes. This checklist reduces avoidable mistakes. It does not guarantee recovery or prove that a recipient is trustworthy. ## Frequently asked questions ### Has my wallet been hacked if I receive a zero-value transaction? Not necessarily. A planted entry can appear without exposing the private key. Check for unauthorised outgoing transfers, approvals or other signs before concluding the wallet is compromised. ### Can I delete a poisoned transaction from the blockchain? No. Confirmed blockchain history is generally not editable by the wallet user. Some wallet interfaces can hide or flag suspicious entries. ### Should I return an unknown token or tiny payment? No. Do not interact merely to return or remove it. Follow the wallet provider's official guidance for hiding or reporting unknown assets. ### Is checking the first and last characters enough? No. Lookalike addresses are designed to match the parts people usually see. Compare the full address from an independently verified source. ### Does a hardware wallet stop address poisoning? It can add a separate display for checking the destination, but it cannot stop you from approving the wrong address. The user still needs a trusted source and complete comparison. ### Does a test transfer make the next transfer safe? No. A test confirms only that one transfer reached one destination on one network. Re-copying from history can introduce a different address later, so verify again. ## Final takeaway Address poisoning does not need to break cryptography. It relies on a familiar-looking entry and a rushed copy-and-paste step. Do not use transaction history as your source of truth. Obtain the destination from the intended recipient or verified service, compare the complete address and network, inspect the signing screen, and stop when anything changes unexpectedly.