Address poisoning: the copy-paste trap in your transaction history

Crypto addresses are long — 42 characters of gibberish like 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18. Nobody types them by hand. We copy them, usually from our own transaction history. Scammers know this, and they have turned that habit into one of the cheapest, most effective thefts in crypto: address poisoning.

How the trick works

The scammer generates an address that looks like one you use — same first few and last few characters, different in the middle. Then they send you a tiny transaction from that lookalike address: a fraction of a cent, or a zero-value transfer that appears in your history as if you sent it.

Now your transaction history contains a poisoned entry. The next time you go to send funds and copy "your" address from history, you may grab the scammer's lookalike instead. Wallets and explorers show addresses shortened — 0x742d…bD18 — so the fake looks identical to the real one. One paste later, your funds are gone, and the transaction cannot be reversed.

Why it works so well

It exploits something reasonable: checking the start and end of an address feels like due diligence. But with modern hardware, generating an address matching 4–6 characters at each end takes minutes. The scammer doesn't need to hack anything — they just need you to trust your own history, which was never designed to be a trusted address book. Anyone can send anything to your address; your history is a public inbox, not a contact list.

How to protect yourself

• Never copy addresses from transaction history. Keep your own address book — in your wallet's contacts, a password manager, or a note you made yourself.
• Check the middle, not just the ends. Compare the full address character by character, or at least a chunk from the middle.
• Send a small test amount first for large transfers, and confirm it arrived before sending the rest.
• Ignore dust transactions. Tiny unexpected transfers and zero-value entries from strangers are bait, not gifts.

Where CapyGuard helps

Address poisoning is a habits attack more than a website attack, but it often arrives wearing a website's clothes: fake "refund" or "claim" pages that show you a lookalike address to send to. CapyGuard's lookalike-domain checks and its pause on large or unusual wallet transactions give you a moment to double-check the address before you sign — which is exactly the moment these scams rely on you skipping.