Address poisoning: how to check a wallet address before you send (step by step)

How the attack works

Wallets shorten addresses to the first and last few characters, like 0xbaf4...B6495F8b5. Attackers generate an address that matches those visible characters and then put it into your transaction history in one of three ways: a tiny "dust" transfer to you, a fake token transfer, or (on EVM chains) a zero-value transfer that looks like it came from you. The next time you open "recent" and copy the top address, it is theirs.

It costs the attacker almost nothing. A Carnegie Mellon study counted about 270 million poisoning attempts on Ethereum and BNB Chain between July 2022 and June 2024, aimed at 17 million wallets, with more than $83 million in confirmed losses. Blockaid says it flagged over 65 million poisoning transactions in 2025 alone, and Solana has its own automated tools for it.

The part most people miss: the test transfer

A test transfer feels safe. In the biggest cases it was the trigger. The victim sends 50 USDT to their own address, a bot sees it on-chain, and within seconds a lookalike address sends dust to the same wallet. The victim then goes back to history to copy "the address that worked" and picks the fake one. The test does not protect you; where you copy the address from does.

The routine, step by step

1. Save every address you send to more than once. Phantom: Settings, Address Book, Add address. MetaMask: Settings, Contacts. Give it a name you would recognise ("Binance deposit SOL"). From then on, send by picking the name, never by pasting.
2. Never copy an address from transaction history. Not in the wallet, not on Solscan or Etherscan. Copy it from the source: the exchange deposit page, your own wallet's "Receive" screen, or the address book.
3. Check the middle, not the ends. Attackers match the first and last characters because those are what you see. Compare 4 characters from the middle of the address against the source. It takes five seconds.
4. After a test transfer, do not go back to history. Send the main amount from the same source you used for the test (address book or the exchange page), not from "recent".
5. Hide spam in your explorer. On Solscan, turn on "Hide spam" and "Hide low value" in the activity table. Zero-value transfers and dust you never asked for are the warning sign that you are being targeted.
6. Use whitelisting on exchanges. Most large exchanges let you lock withdrawals to saved addresses only, with a waiting period for new ones. Turn it on before you need it.

If you already sent to the wrong address

A blockchain transfer cannot be reversed. What still helps: post the transaction hash and the attacker address quickly, report it to the exchange the funds move to (exchanges can freeze deposits if they are told in time), and file a police report, which exchanges often ask for. Large thefts have been partly frozen this way, small ones rarely are, which is why the routine above matters more than the recovery.

Related: the fake support call script and how to spot a rug pull.

Compare tools: Best crypto wallets

Not financial advice. Numbers are measurements of past tokens and calls; meme coins are extremely risky and most go to zero.