Crypto address poisoning: lookalike addresses and copy-paste traps

On many chains, anyone can send a tiny amount (dust) or a zero-value transfer that appears in your wallet activity. Attackers craft addresses whose leading and trailing characters match a real address you previously used — an exchange deposit, a cold wallet, or a counterparty. When you later paste “from history,” muscle memory picks the poisoned lookalike.

Variants include vanity-like prefixes, spoofed token transfer notifications, and phishing UIs that pre-fill a wrong destination. The common failure mode is the same: you authorize a real transfer to an address you did not intend.

• Dust or spam txs appear from unknown addresses that resemble your contacts.
• You copy from recent activity instead of from a verified address book.
• Only the middle characters differ — easy to miss on a phone screen.
• Funds leave in one confirmed transaction; there is no “undo” button on-chain.

1. Maintain an allowlist or address book for frequent destinations; add entries only after character-by-character checks.
2. Compare the full string, not just the first and last four characters.
3. For large transfers, send a small test amount first, confirm receipt, then send the rest.
4. Prefer QR codes or copy from the exchange’s deposit page you opened yourself — not from chat or email.
5. On hardware wallets, read the destination on the device screen before approving.
6. Ignore unsolicited incoming dust when choosing a paste source.

Never ask a stranger in DMs to “confirm” an address. Impersonators will confirm the poisoned one. Use official account pages and known contacts through a second channel.

Stop further sends to that destination. Confirmed transfers are generally irreversible. Do not pay anyone who claims they can reverse the tx for a fee or with your seed phrase — that is a recovery scam pattern.

1. Copy the outgoing transaction hash, network, amount, asset, and exact destination address.
2. Note the intended destination (the real address you meant) and how you selected the wrong one (history paste, chat, etc.).
3. Screenshot wallet activity showing the dust/poison txs if still visible.
4. Secure remaining funds; poisoning itself does not steal a seed, but phishing follow-ups often arrive next.
5. Prepare a short timeline for police or counsel if the amount warrants reporting.

Day-one priorities match other losses: preserve evidence, avoid second scams, decide whether tracing helps. See our first-24-hours guide.

Authorities need primary identifiers: the mistaken send hash, the poison destination, and context that you intended a different address. If the attacker later moves funds into a custodial exchange, a compliance contact may become relevant — only when the path supports a deposit story.

• Outgoing victim txid and explorer link.
• Poison address and any earlier dust txids from that address to you.
• The intended address and proof of prior correct sends if available.
• UTC timestamps and asset amounts.
• Any chat where an address was supplied (for social-engineering variants).

Exchanges do not reverse the chain for you. They may restrict withdrawals on accounts they control if policy and law allow. Our exchange-freeze guide covers factual contact language. Our police guide outlines packet structure without promising outcomes.

Tracing follows value from your mistaken send through hops toward mixers, bridges, or labeled custodial clusters. The deliverable is a path document with confidence language — useful for reporting when you cannot see the cash-out yourself.

• Helps when funds left the poison address and you need a letter-ready hop table.
• Helps when multiple chains or bridges obscure the trail.
• Does not recover coins, force freezes, or guarantee a KYC recipient.
• May end in unlabeled wallets — an honest report will say so.

MBTrace produces that investigation PDF (from $50+, typically 24–48h after payment, analyst accepts before payment). Never seeds or keys. See /sample-report.pdf for tone and structure. Soft CTA: report a case if you need a path document — not a recovery promise.

Address poisoning tricks a human into signing a payment to the wrong place. Wallet drainers abuse token approvals or malicious signatures. Seed phishing steals the recovery phrase and empties the wallet later. Different mechanisms need different containment: revoke approvals for drainers, abandon the seed for phishing, and tighten address hygiene for poisoning.

After any loss, recovery scammers recycle the same scripts. Read our recovery-scams guide before engaging anyone who guarantees return of the mistaken send.

• Name destinations in your wallet’s address book; avoid nameless history paste for large amounts.
• Use separate wallets for receiving spam-prone activity vs long-term storage.
• Double-check on a second screen or paper for high-value transfers.
• Disable or hide spam/dust tokens in UI settings when available — still verify the payment address itself.
• Bookmark official exchange domains; typed URLs beat search ads.

This article is general information, not legal advice. Local reporting channels differ. Tracing and compliance contact do not guarantee recovery.