Address Poisoning.

Address poisoning seeds a victim's transaction history with attacker-controlled lookalike addresses so they later copy-paste the wrong one and send funds to the attacker. It belongs to the Web3 & Blockchain category of cybersecurity.

Address poisoning seeds a victim's transaction history with attacker-controlled lookalike addresses so they later copy-paste the wrong one and send funds to the attacker.

In an address-poisoning scam, attackers generate vanity addresses whose first and last characters match an address the victim has recently interacted with. They then send a zero-value transfer or tiny token transfer from that lookalike to the victim, so it appears in their wallet history. Later, when the victim copies an address from history rather than from a trusted source, they may paste the attacker's address and authorize a transfer. The technique was widely abused throughout 2022 to 2024 and has caused multi-million-dollar losses on Ethereum and BSC. Defences include never copying addresses from transaction history, using contact books, ENS, or hardware-wallet on-device address verification.

Defences for Address Poisoning typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Wallet address poisoning, Vanity-address phishing.