Agent Lane robot mascotAgent Lane
Menu

Guide

Address poisoning: the crypto scam that hides in your wallet history

Short answer: Scammers send a tiny or zero-value transfer from an address that starts and ends like one you use, so it shows up in your history. If you copy it next time, your crypto goes to them. Don’t copy addresses from your transaction history, save checked addresses in your wallet’s address book, and check the middle characters, not just the start and end.

By Agent Lane Editorial · Page dated 3 November 2026

What is address poisoning?

MetaMask describes it as a scam where attackers send you a tiny transaction from an address that closely resembles one you’ve used before, hoping you’ll copy it by mistake and send funds to them instead. Nothing is stolen when the tiny transfer arrives. The danger comes later, when you copy the wrong address.

How does it work?

  1. You send crypto to a friend, or to another account of your own.
  2. The scammer’s software spots the transfer, often in stablecoins, and creates an address that looks like yours or your friend’s.
  3. They send you a transfer worth nothing (often zero tokens) from that lookalike address, so it appears in your wallet history.
  4. Wallets usually shorten addresses to the first and last few characters. Next time you copy an address from your history, you may pick theirs.
  5. Once a transfer is confirmed it can’t be changed, so MetaMask says the funds are gone.

How do I protect myself?

  • Don’t copy addresses from your transaction history, including your own.
  • Save addresses you’ve checked in your wallet’s address book (MetaMask calls it Contacts) and send from there.
  • Check the middle characters, not just the start and end. Those are what a lookalike address is built to hide.
  • Use a hardware wallet for bigger amounts. MetaMask notes most make you confirm the address on the device itself.
  • Heed your wallet’s warnings. MetaMask says it now shows a blocking warning when an address closely resembles one you’ve used, and an alert when you send to a new address.
  • Ignore tokens and tiny transfers you didn’t expect. Don’t try to sell or move them through a site you don’t know; see fake airdrops.

Is an AI assistant safer at copying addresses?

Not automatically. An AI that copies an address from your history can fall for the same trick. If you let an AI send crypto, keep it to a small wallet, and check the full address yourself before you approve. See what is an AI agent wallet?

What if I already sent to the wrong address?

Follow sent crypto to a scammer: the first 24 hours. In short: if you sent from an exchange, contact it right away; save the addresses, amounts, times and transaction ID; and report it at ic3.gov and ReportFraud.ftc.gov. Be wary of anyone offering to recover it for a fee.

Sources

Checked 3 November 2026 on each organization’s own site.

Related guides

All guides