Address Poisoning.

In an address-poisoning scam, attackers generate vanity addresses whose first and last characters match an address the victim has recently interacted with. Because Ethereum addresses are 40 hexadecimal characters and wallets truncate them in the UI (e.g. 0x1a2b…f9e0), matching just the first and last 4–6 characters is enough to fool a human skimming their history. Attackers brute-force these lookalikes on GPUs using tools derived from profanity-style vanity generators, then "poison" the victim's history so the fake sits next to the real address.

Two seeding techniques dominate. A zero-value transfer calls a token's transferFrom with amount 0, which many ERC-20 contracts permit without any prior approval, emitting a Transfer event from the victim to nowhere and inserting the attacker address into history. Fake-token transfers use a malicious contract that mints a worthless token with a name like "USDT" to make the poisoning entry look genuine.

The most infamous case struck on 3 May 2024, when a whale sent 1,155.28 WBTC (~$68 million) to a poisoned lookalike; the thief later returned the funds on 9 May after on-chain sleuths and the appreciation of the stolen ETH made laundering impractical. The technique was industrialised throughout 2022–2024 across Ethereum, BSC, and Tron.

flowchart TD
  A[Attacker brute-forces vanity address<br/>matching victim's counterparty prefix+suffix] --> B[Seed history: zero-value<br/>or fake-token transfer to victim]
  B --> C[Poisoned entry appears in<br/>wallet transaction list]
  C --> D{Victim copies address<br/>from history?}
  D -- Yes --> E[Funds sent to attacker]
  D -- No, uses address book / ENS --> F[Safe transfer]
  E --> G[Attacker launders or ransoms funds]

Defences: never copy an address from transaction history; use an address book, ENS/verified name, or QR codes; verify the full string on a hardware wallet's screen; and treat any unexpected zero-value or unknown-token entry as a poisoning attempt rather than a real payment.