What Is Address Poisoning? Your Test Payment Brings the Fake

A test payment is the most careful move in a big transfer. It's also public. You're moving savings from your wallet to your exchange account, so you send a small amount first. It lands, and the relief arrives with it: right network, right address, nothing lost. All that's left is the real send. You go back to your wallet's history to copy the address again, and by then the history can hold lines you never wrote.

That is address poisoning. A scammer makes an address whose ends match one you just paid. A tiny transfer, or a forged record of one, slips it into your history, and then the scammer waits for your next copy-paste. Nothing gets hacked and no key is touched. The money leaves on your own signature, to an address you picked from a list you trusted.

Eunha, the guide here for the inside of a decision, distrusts the steps that have stopped feeling like choices, and a test that just landed is one of them. One wallet shows how fast that moment gets used. Its first payment ever went out on 9 November, eleven years after it was funded, and eight fake addresses followed it.

She lines that history up against the clock: the test left a few minutes after ten at night, UTC. Forty-eight seconds later the first forgery arrived. By the time the real transfer went out, thirty-eight minutes on, the history had gained one line from its owner and forty-eight from strangers.

What is address poisoning?

"Your history looks like a diary, and it works like a mailbox," Eunha says. Anyone who knows an address can put something in it. Nobody's address on a public chain is a secret.

The scammer's work begins with an address built to look like one you pay. Wallets and explorers shorten an address to something like 0x1321…1A44, so the fake only has to copy what that shortening keeps.

A lookalike is useless until it sits in your history, and getting it there is cheap. It can send you dust, a sliver of real coin, or a transfer worth nothing, and show up as an incoming line. A forged send does better, because it puts the fake where you'd look for a payment you made. A token's contract keeps its own books, and a scammer can write one that records a transfer from you to the fake. It can borrow the coin's name and your payment's exact size. Your history then shows a payment you never made. None of it moves a coin out of your wallet, and the fake can wait in your history for months at no cost to you.

Your paste is what moves the money.

That makes address poisoning the odd one among wallet attacks. A token approval is a permission you sign. A hijacked dApp front end builds a bad request for you to approve, and an EIP-7702 delegation can let someone else's code act as your account. Address poisoning asks for none of that. You send your own coin to an address you supplied, so the signing screen shows an ordinary transfer. The only wrong thing on it is a string you chose.

A diary and a mailbox keep different records. Your bank statement lists what the bank booked. A wallet's history lists whatever reached the address, true or forged, and the chain itself doesn't vet a line of it.

Writing into yours costs a stranger pocket change.

Eight fake addresses after one 0.05 ETH test

The wallet Eunha replays had been quiet since Ethereum's first day. It received 1,400 ETH in the genesis block and more the following spring. For over ten years it never sent anything. On the evening of 9 November it sent 0.05 ETH to an address beginning 0x1321 and ending 1A44, the first outgoing transaction of its life.

What arrived first was a forgery. A token whose name displays as ETH, spelled with Cyrillic and Greek letters and padded with invisible characters, recorded a matching "send" from the wallet to a lookalike. In the same block, another lookalike got gas money from an account Etherscan flags as phishing. That second fake then dusted the wallet every minute or so, forty-three times in all.

Thirty-eight minutes after the test, the real transfer left: 2,154.95 ETH, about $4.6 million at that day's price, to the address the test had gone to. Nothing was lost.

Ninety-six seconds later two forgeries claimed the full amount had gone to a fake, so the fake line now carried the real figure as well. The forging ran until 12 November. By then the history held thirty forged sends from seventeen token contracts and forty-seven tiny or zero transfers, naming eight different fakes. All forty-three of the dusting fake's transfers had cost it about eighteen cents in fees.

"Open that list a week later and each real payment sits among forgeries of its own size. Checking the amount tells you nothing," Eunha says.

Why does address poisoning follow a test payment?

For years Eunha thought of a test that arrived as the last check she'd need. It felt like the opposite of risk: a small amount, sent deliberately, so that nothing could go wrong with the big one. What she never pictured was who else saw it.

A test publishes four things at once: the destination, the asset, an amount to copy and a promise. The promise is that a bigger send to that address is probably minutes away. A bot watching new transfers can't tell which payments are tests, and it doesn't need to. It answers fresh payments with matching fakes, sometimes within seconds. The test is simply the payment a large send is surest to follow, from someone about to reach for the history.

The test isn't the mistake. It's the template the fake is cut from.

Bitquery went through a year of Ethereum transfers and found the same pattern. In one August case a forgery arrived twelve seconds after a test, and the victim's real payment followed it to the fake thirteen minutes later. Of that case, Bitquery writes that the test payment "is what made the bait". In a quarter of the thefts it counted, ten minutes or less separated the victim's first payment to the real address from the fake that copied it.

One case stays with Eunha, the largest theft Bitquery found. For two years one wallet paid one address by a fixed routine: 50 USDT as a test, then the full amount. Fourteen payments made that way moved about $400 million. In December 2025 the usual test went out again. Three minutes later a zero-USDT "transfer" from the wallet to a lookalike appeared in its history. Twenty-six minutes after the test, 49,999,950 USDT went to the fake.

"Fourteen times that routine kept the money safe. And fourteen times it showed anyone watching what the fifteenth would look like," Eunha says.

A routine protects you from your own mistakes. Against a watcher it becomes a tell, and the steadier it is, the easier it is to use against you. Your bank's test wire stays between you and the bank.

On a public chain, caution gets published like everything else.

The fake doesn't have to work at once, either. Bitquery's median time from bait to theft is 4.5 days, so a lookalike planted after this week's test can wait for next month's payment. Each attempt costs the scammer about $1.86 in fees, and only one targeted wallet in 4,891 paid a fake. Over the year, thefts still came to a measured $76.1 million, about four times what the fees cost. A scam that fails nearly every time is still a business, as long as failing stays cheap.

How many characters does a fake address match?

"Four at the front, four at the back. I checked them before every send," Eunha says. It was common advice, and the wallet walkthrough on this site gave it too. Six of the eight fakes aimed at the genesis wallet would have passed it.

Four and four makes eight characters to fake. An Ethereum address is forty hexadecimal characters after the 0x, and each has sixteen possible values. Matching eight chosen characters takes about sixteen to the power of eight tries on average, roughly 4.3 billion. That sounds like a wall until you see the clock. An open-source vanity-address generator publishes its own benchmark: about three seconds for eight characters on one RTX 4090, and about nineteen on a ten-year-old card.

Each extra character multiplies the work by sixteen. On the faster card, ten characters would take about thirteen minutes and twelve would take more than two days. So a fake is fitted to what screens show and not a character more. All eight fakes begin 132 and end 1a44.

The weak spot isn't the address, it's the way screens shorten it.

The two fakes that fail four-and-four don't fail it by much. They match three characters at the front and make up for it with five or six at the back. Bitquery's data says that trade works. In every theft it found, the fake matched three or more characters at each end, and in 57% it matched exactly four and four. The $50 million fake matched three at the front and four at the back: the real address began 0xbaf4, the fake 0xbaff.

The middle is where a fake has nothing to offer. Pick any four characters from the middle of the address you mean to pay. A fake fitted to the ends matches them only by chance, about one time in 65,536, because nobody spent a second of graphics-card time on them. That check costs you a few seconds, and no scammer can pay for it in advance.

Should you still send a test transaction?

Yes, and Eunha still does. A test transaction proves the network, the address and that the receiving side can see the funds. It doesn't prove your next paste. So the second copy has to come from the same place as the first: the receiving wallet's own Receive screen, the exchange's deposit page, or an address-book entry you saved from that source yourself.

The history is for reading, never for copying.

Wallet makers say much the same. Trust Wallet's glossary tells you never to copy addresses from history and to check a chunk from the middle as well as the ends. It also tells you to send a small test amount first for large transfers. Those three tips agree: a test is worth sending, as long as its line in your history is never what you copy.

Watch the minutes between test and send, too. Any new line that carries your recipient's ends and turned up after the test is the bait, and it means someone saw the test. Dust you didn't ask for is not a gift but a warning. If your wallet lets you hide unknown tokens and tiny transfers, hiding them keeps the forged lines away from a hurried thumb.

The address you're likeliest to stop checking is your own. Bitquery found that 28.3% of thefts used a lookalike of the victim's own exchange deposit address. Paying yourself feels like the safest transfer there is, so the second paste gets the least attention there.

Some of the missing attention has started to come from software. Etherscan now marks low-value transfers on an address page as a possible sign of address poisoning, and some wallets warn at signing. A warning at signing interrupts one moment, though, while the fake has usually sat in the history for days. By Bitquery's estimate, those warnings catch one theft in six.

For the other five, what protects you is where the second copy came from.

A history strangers can write to

Eunha changed one thing about her transfers, and it wasn't the test. Every address she pastes now has a known author.

Your history is co-written by strangers, and your wallet's screen doesn't mark which lines are theirs. That isn't a flaw waiting for a patch, it's what a public ledger is. Anyone can write to an address, so the record of an address is only as trustworthy as its least honest author.

A test proves an address once. Whatever you copy after it has to prove itself again.

How much does your routine give away? Make your next five simulator trades exactly the way you usually do, and afterwards look back through your Trade History as if it belonged to someone you were watching: guess the sixth trade's coin, size and day. A watcher on a public chain gets that list from any block explorer, so on your next real transfer let an address-book entry you saved from the source fill the second paste.

Start free →