What Is Address Poisoning? Lookalike Address Scam Guide
# What Is Address Poisoning? Lookalike Address Scam Guide
Address poisoning is a quiet scam built around one everyday habit: copying a wallet address from your recent transaction history. A crypto address is a long string of letters and numbers, so most people check only the first few and last few characters before pasting. Scammers know this. They create a lookalike address that matches those visible ends, plant it in your history with a tiny transfer, and wait for you to copy the wrong one.
> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose.
This guide explains how address poisoning works step by step, why it succeeds so often, and the simple habits that protect Indian users every time they send crypto.
What Is a Wallet Address, and Why Is It Easy to Fake?
A wallet address is the public destination you share to receive crypto, similar in spirit to a bank account number — except it is much longer and has no name attached to it on screen. An address might look like a random string of forty or more characters. Because nobody memorises such strings, wallets and exchanges show a shortened view: the first few characters, three dots, and the last few characters.
That shortened view is the weakness. Two completely different addresses can share the same beginning and ending. The middle characters decide who actually receives the money, yet the middle is exactly what most screens hide. Address poisoning exploits that gap between what you see and what you actually copy.
Think of it like a phone number with one digit changed in the middle. If you glance only at the area code and the last two digits, the wrong number looks correct — until your call reaches a stranger.
How an Address Poisoning Attack Unfolds
Step 1: The scammer studies your public activity
Blockchain transactions are public. Anyone can see which addresses a wallet has sent to and received from. An attacker picks a wallet that moves crypto regularly and notes the addresses it deals with most — for example, your own second wallet or an exchange deposit address you use often.
Step 2: The scammer generates a lookalike address
Using software, the attacker creates a new address whose first and last characters match the real one as closely as possible. Generating millions of candidate addresses until one matches at both ends is cheap and fast for a computer. The middle characters differ — and that difference routes funds to the scammer.
Step 3: A tiny "dust" transfer plants the trap
Next, the attacker sends a very small amount — sometimes almost zero — from the lookalike address to your wallet. Some attempts use a fake token designed to appear in your history. The transfer itself steals nothing. Its only job is to make the fake address appear in your recent activity, right beside the genuine one.
Step 4: You copy the wrong address later
Days or weeks later, you want to send crypto to that familiar destination again. Instead of opening your address book, you scroll through your history, spot an address with the right start and end, and copy it. It is the scammer's address. You confirm the transfer — and blockchain transfers cannot be reversed.
| Stage | What you see | What is really happening |
|---|---|---|
| Dust transfer arrives | A tiny deposit from a familiar-looking address | A lookalike address is being planted in your history |
| You check history later | Two addresses with the same start and end | Only one is genuine; the middle characters differ |
| You copy and send | A normal transfer screen | Funds are addressed to the scammer's wallet |
| Transfer confirms | Transaction successful | The transfer is final and cannot be undone |
Indian users often move crypto between an Indian exchange such as CoinDCX, WazirX, or ZebPay and a personal wallet, sometimes in a hurry around work, travel, or market news. Hurried transfers on a small phone screen make the shortened-address problem worse: even fewer characters are visible, and the pressure to finish quickly discourages a full check.
There is also a habit factor. Many beginners keep no address book at all, so transaction history becomes their address book by default — which is precisely the list the scammer has poisoned. Finally, INR deposits through UPI feel familiar and reversible like bank transfers, but a confirmed crypto transfer is not. That difference catches people off guard.
Warning Signs of a Poisoned History
Watch for these clues before you copy any address:
- A tiny or zero-value deposit you do not recognise, from an address you never dealt with knowingly.
- An unfamiliar token appearing in your wallet without any purchase by you.
- Two very similar addresses in your history for what you thought was one destination.
- A transfer entry dated just before you planned a bigger transfer to the same person or wallet.
- Messages or group posts urging you to "claim" something linked to that deposit — a common follow-up trick.
How to Protect Every Transfer
Never copy addresses from transaction history
Make this a hard rule. History is a record, not an address book. If you take one lesson from this guide, take this one — it removes the trap entirely.
Use an address book or whitelist
Most wallets and Indian exchanges let you save and label addresses, and many exchanges offer withdrawal whitelisting. Save each destination once, carefully, with a clear label like "My hardware wallet" or "Brother's wallet". After that, always select the saved entry instead of pasting anything.
Verify the full address, not just the ends
When you must use a new address, compare the complete string character by character against the source — ideally on the receiving device or app itself. Some wallets can display the full address on demand. Pay special attention to the middle section the shortened view hides.
Send a small test transfer first
For a new destination, send a small amount first, confirm it arrived in the correct wallet, and only then send the rest. The extra network fee is cheap insurance compared with losing a full transfer to a lookalike address.
Check the network as well as the address
Confirm the destination network matches — for example, sending on the wrong network can strand funds even when the address is right. Address and network must both match the receiver's instructions.
Ignore unsolicited dust and tokens
Do not interact with unknown tokens, and never follow links or scan codes that arrive with them. Interacting can expose you to further scams. Simply leave the entry alone.
What to Do If You Sent Crypto to a Poisoned Address
Act quickly, but understand the reality first: a confirmed blockchain transfer cannot be reversed by any exchange, bank, or authority. Still, these steps matter:
- Stop further transfers and check whether any other saved or copied addresses came from the same history.
- Save the evidence — transaction ID, both addresses in full, dates, and the amount in INR.
- Contact the exchange if either side involved an exchange account, and share the transaction details; platforms can sometimes flag the receiving account if funds arrive there.
- Report the incident on India's national cybercrime portal (cybercrime.gov.in) or helpline 1930.
- Rebuild your address book from original sources — the receiver's own app or device — never from history.
Frequently Asked Questions
What is address poisoning in simple words?
Address poisoning is a scam where an attacker sends you a tiny or zero-value transfer from a wallet address that looks almost identical to one you use. Later, when you copy an address from your transaction history, you may copy the scammer's lookalike by mistake and send your crypto to them instead of the intended person.
How can I tell a real wallet address from a poisoned one?
Do not judge an address by its first and last few characters alone, because scammers copy exactly those parts. Compare the full address character by character, or better, use a saved address book or whitelist entry that you verified earlier. If anything differs in the middle, stop and check again.
I received a strange tiny deposit in my wallet. What should I do?
Do nothing with it and do not copy any address from that transaction. Unsolicited tiny transfers are often the bait in a poisoning attempt. Simply ignore the entry, use only addresses saved in your own address book, and never interact with unknown tokens or links that arrive with such deposits.
Conclusion
Address poisoning needs no hacking and no password — only one careless copy-paste. The defence is equally simple: never copy from history, save verified addresses in an address book or whitelist, check the full string plus the network, and test with a small amount first. Build these habits before your next transfer, and a poisoned history becomes harmless background noise.
Keep Learning
Frequently asked questions
What is address poisoning in simple words?
Address poisoning is a scam where an attacker sends you a tiny or zero-value transfer from a wallet address that looks almost identical to one you use. Later, when you copy an address from your transaction history, you may copy the scammer's lookalike by mistake and send your crypto to them instead of the intended person.
How can I tell a real wallet address from a poisoned one?
Do not judge an address by its first and last few characters alone, because scammers copy exactly those parts. Compare the full address character by character, or better, use a saved address book or whitelist entry that you verified earlier. If anything differs in the middle, stop and check again.
I received a strange tiny deposit in my wallet. What should I do?
Do nothing with it and do not copy any address from that transaction. Unsolicited tiny transfers are often the bait in a poisoning attempt. Simply ignore the entry, use only addresses saved in your own address book, and never interact with unknown tokens or links that arrive with such deposits.
Related guides
- How to Verify a Token Contract Address Before Buying — Learn how to verify a token contract address before buying crypto in India — check the official source, explorer, and red flags that expose fake tokens.
- Binance $3.64 Billion Outflows Explained for Indian Users — Binance customers pulled a net $3.64 billion as withdrawals reopened after the hack. What outflows mean, why figures differ, and what Indian users should check.
- Binance Withdrawals Resume: What Indian Users Must Know — Binance withdrawals resumed on 1 November 2026 in phases, starting with Bitcoin. What reopened, what is still pending, and the safe checklist for Indian users.