In this article · 6 sections
Address poisoning does not hack anything. The attacker sends a tiny or zero-value transfer to your wallet from an address that starts and ends like one you use, so it sits in your history looking familiar. The next time you copy 'your' address from that history, you copy theirs. Cheaper Ethereum fees since the Fusaka upgrade of 3 December 2025 made the trick almost free to run at scale: Blockaid counted 628,000 attempts in November 2025 and 3.4 million in January 2026. The fix is a habit, and it takes about 30 seconds.
The short answer
Never copy an address from your transaction history. Use a saved contact or the address shown in the receiving wallet itself, compare the whole string rather than the first and last few characters, and for large amounts send a small test and confirm it arrived through a separate channel. Attackers watch for test transfers, so the test alone is not enough: re-copy the address from the trusted source for the main transfer too.
How the attack works
Variants include fake token transfers that mimic USDT, and look-alike nested accounts created for multisig users. The principle is always the same: pollute the place you copy from.
- The attacker watches the chain for wallets that move meaningful amounts, especially stablecoins
- They generate an address whose first and last characters match one you send to often
- They send you a zero-value or tiny transfer from it, so it appears in your history next to the real one
- Wallets and explorers shorten addresses to the first and last characters, so the two look identical
- You copy the wrong one. The transfer is final; there is no chargeback on a blockchain
Why it exploded after Fusaka
Each poisoning attempt is a transaction, so it costs a fee. Ethereum's Fusaka upgrade, live on 3 December 2025, cut transaction costs by roughly six times according to Blockaid, which removed the main brake on mass campaigns. Blockaid counted 628,000 poisoning attempts in November 2025 and 3.4 million in January 2026, a 5.5-fold rise in two months. It has flagged more than 65.4 million poisoning transactions since January 2025 and about 316,000 confirmed cases where a victim sent funds, roughly one in 200 attempts. Coin Metrics data cited by Blockaid shows stablecoin 'dust' transfers rising from 3–5% to 10–15% of Ethereum transactions after the upgrade.
These are a security vendor's figures. The independent academic baseline is older and smaller but points the same way: a Carnegie Mellon study presented at USENIX Security found more than 270 million attempts targeting over 17 million victims on Ethereum and BNB Chain between July 2022 and June 2024, with 6,633 successful transfers worth over $83.8 million.
Sources: Blockaid, 9 Mar 2026 · Carnegie Mellon CyLab, 7 Jan 2026 · 'Blockchain Address Poisoning' (arXiv)
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
Two real cases
December 2025: a trader sent a $50 test transfer of USDT. The attacker saw it, planted a look-alike address, and the trader then sent 49,999,950 USDT to the poisoned address, about 12 to 26 minutes later depending on the report. The funds were laundered within the hour.
30 January 2026: a holder lost 4,556 ETH, about $12.4 million at the time, after the attacker had been 'dusting' the wallet since December, the last time about 32 hours before the theft. Patience is part of the method.
Sources: Cointelegraph ($50M USDT case) · Blockaid (both cases)
The 30-second check before any transfer
Do these every time, not only for large amounts. They take less time than reading this paragraph.
- Copy the address from a saved, labelled contact or from the receiving wallet's own 'receive' screen, never from history
- Compare the full address, including the middle, or check it on the hardware wallet's screen character by character
- For large amounts, send a small test and confirm receipt with the recipient through another channel
- Re-copy the address from the trusted source for the main transfer; do not reuse the line from the test
- Hide or ignore zero-value and unknown token transfers in your wallet settings
If you already sent funds to a poisoned address
Act fast but carefully. Record the transaction ID and both addresses. If the funds were a stablecoin such as USDT or USDC, contact the issuer and the exchange you sent from immediately: issuers can freeze tokens in some cases, as Tether did for about $10 million in another case in October 2026. Report to your national cybercrime unit. Expect 'recovery experts' to contact you and do not pay them; our crypto scams guide explains why.
Quick answers
Can address poisoning steal from my wallet without me doing anything?
No. It only works if you copy the attacker's address and send funds to it yourself. Your keys and existing funds are not touched by the dust transfer.
Should I interact with the dust transaction?
No. Don't send it back or try to 'clean' it with unknown apps. Hide it in your wallet and keep copying addresses from saved contacts.
Does a hardware wallet protect me?
Only if you read the full address on its screen before approving. The device will sign whatever address you give it.