Address poisoning

The target is a habit: reaching into a wallet's transaction list to reuse an address instead of asking the recipient for a fresh one. Attackers grind out lookalike addresses that match the first and last few characters, which is all most wallet screens and block explorers display. In May 2024 one trader lost 1,155 wrapped bitcoin, worth about 68 million dollars, to a single poisoned paste.

How it works

Address poisoning has three stages, and only the last one involves you.

Grinding the lookalike. Bitcoin addresses are long by design, and interfaces hide the middle. A bech32 address uses a 32 character alphabet, so producing one that matches four leading and four trailing characters of a target means searching roughly 32 to the eighth power, about 1.1 trillion candidates. A single commodity GPU running overnight gets there, and the search is embarrassingly parallel, so a rented rig can poison thousands of targets at once. The attacker does not need your key, only an address of their own that looks like the one you trust.

Planting it. On bitcoin the attacker spends a dust amount, typically 330 or 546 satoshis, from the lookalike address to yours. Your wallet records an incoming payment, and the sender field now displays an address a glance cannot distinguish from the one you actually use. Some campaigns instead poison the other direction, sending from an address resembling the exchange deposit address you keep pasting into your own withdrawals.

Waiting. Weeks later you go to send. You scroll the history, find "the address I used last time", copy, paste, confirm. The transaction is valid, correctly signed, and irreversible from the moment it confirms roughly ten minutes later. There is no fraud department, because no fraud occurred at the protocol level: you paid exactly who you told the network to pay.

The economics differ by chain. Ethereum lets an attacker emit a zero-value transfer for gas alone, so poisoning there is nearly free and runs at industrial scale. Bitcoin's dust rule forces a small payment per attempt, which is one of the few places that policy quietly acts as spam control.

Why this matters when you buy bitcoin

The riskiest minute in a new buyer's life is the first withdrawal from an exchange to a wallet they just set up.

That is when you are copying an unfamiliar string between two apps, when you have no address book yet, and when you are least likely to notice that the middle 20 characters changed. It is also when the amount is often your entire position. Three controls remove almost all of the risk, and none of them depend on being careful.

Set a withdrawal whitelist. Kraken, Coinbase, and Binance all let you register the addresses your account is allowed to send to, and most enforce a delay before a newly added address becomes usable. You configure it once, calmly, while nothing is being stolen. A poisoned address pasted into a whitelisted account is simply rejected.

Get the address from the receiving device, not from history. A hardware wallet generates and displays your receive address on its own screen. Trezor and Ledger both make you confirm it there, and malware or a spoofed history on the computer cannot change what the device shows. Do the same in reverse when sending: read the destination off the device screen before you approve.

Check the middle. Comparing the first four and last four characters is precisely the check the attack is built to pass. Compare a run of characters from the center of the string, or better, compare the whole thing by scanning a QR code rather than reading.

The 68 million dollar paste

On May 3, 2024, a trader prepared to move 1,155 wrapped bitcoin, then worth roughly 68 million dollars, and did the responsible thing first: a small test transfer.

An attacker was watching the mempool for exactly that pattern. Within minutes they created an address matching the first and last characters of the legitimate destination and sent a token transfer from it, so that the poisoned entry landed in the sender's history immediately above the real one. The 1,155 coin transfer went to the attacker.

The ending is unusual. On-chain investigators traced the attacker's infrastructure and publicized it, and about a week later the funds were returned in full. Nothing about that outcome is repeatable. Recovery happened because the sum was large enough to attract public forensic attention and the attacker decided the heat was not worth it, not because any protocol or company had a way to reverse the payment.

Address poisoning vs dusting attack

Address poisoning and dusting attacks both arrive as a tiny unexpected deposit, and they aim at different mistakes. A dusting attack wants the coin itself back in circulation, spent alongside your other outputs so that a chain analyst can merge the two into one cluster. Address poisoning does not care what happens to the dust at all; the payload is the sender address sitting in your history. Freezing the output protects you from the first attack and does nothing about the second, which is why the real countermeasure here is never sourcing an address from a transaction list.

Address poisoning vs clipboard malware

Both attacks end with bitcoin going to a string you did not intend, and they attack different parts of the chain of custody. Clipboard malware requires code running on your machine and swaps the address between copy and paste, so the address you looked at was right and the one you sent to was not. Address poisoning needs no access to your device at all: the wrong address was already in your wallet's own history, placed there by a payment anyone could make. That makes poisoning immune to antivirus software and reachable by anyone who knows one of your addresses.