You open your wallet to send funds. Recent transactions look fine, so you grab the last address you sent to and paste. A few minutes later, the tokens land in a lookalike address that isn’t yours. Nobody “hacked” you. Your history tricked you.
This is address poisoning. It’s quiet, cheap, and it preys on routine. Attackers don’t break in. They plant something in your path and wait for you to step on it.
And lately, it’s everywhere you look in on-chain histories, especially where gas is cheap and people are moving fast.
Address Poisoning Has Become Routine
Editor's note: In Q1 and Q2 2026 I kept seeing the same pattern on desks I speak with in London, Dubai, and Nairobi: nobody was getting “hacked,” yet funds were vanishing after routine payments. When we traced them, histories were littered with zero-value lookalikes, especially on Base after the early-year memecoin flurries. My own ops shifted to a strict address book and test-sends on anything material. It’s not elegant, but it stops the easy mistakes. The bigger lesson: wallet UX needs to make the safe path the path of least resistance. — Karim Daniels
Address poisoning is a social-infrastructure attack that uses the way we handle addresses against us. Wallets show a list of past recipients. Explorers abbreviate addresses to first and last characters. Most of us copy and paste instead of saving contacts. Attackers know this.
They create a vanity address that shares the same starting and ending characters as a real counterparty. Then they inject that address into your history with a dust or zero-value transaction. Weeks later, when you need to pay that vendor again, you copy the lookalike. Gone.
When UI habits harden into shortcuts, they become attack surfaces. Address poisoning exploits the shortcut, not the cryptography.
Wallet teams and educators have been sounding louder alarms. In July 2026, Binance Academy refreshed its guidance, highlighting how attackers craft lookalike addresses and plant them via tiny or zero-value transfers so users later copy the poisoned entry (Binance Academy — 'How Do Crypto Address Poisoning Attacks Work?').
Where Address Poisoning Came From
There’s a lineage here. Early “dusting” attacks scattered tiny token amounts to deanonymize users. Spam transactions probed mempools for arbitrage. As blockspace got cheaper on L2s and user behavior standardized, spammers pivoted from noise to nudging.
From dust to deception
Dust used to be the endgame. Now it’s the delivery mechanism. The payload is the lookalike address appearing in your recent activity. The goal isn’t to move markets or jam a mempool. It’s to edit your memory by editing your UI.
Why users fall for it
Most interfaces shorten addresses like 0x12ab...9881. Humans recognize patterns by edges. If the first four and the last four characters match, it “feels” right. Add time pressure, mobile screens, and habit. You can guess the rest.
How Fake Histories Are Built
Walk through a typical poisoning playbook. It’s low cost, repeatable, and tuned to how wallets present information.
Attacker toolkit
Two ingredients matter: a vanity address that shares the same visible edges as the target, and a way to plant it into the victim’s history. According to Binance Academy’s July 2026 update, attackers generate lookalikes that match the first and last characters and then send dust or zero-value transactions so the address shows up in the victim’s history (Binance Academy).
Sequence of a poisoning
- Recon: The attacker finds a target wallet that recently paid a counterparty address.
- Forge: They generate a vanity address that shares visible edges with the real one, for example 0xA1b2...F00D versus 0xA1b2...F00c.
- Plant: They send a tiny transfer, or even a zero-value transaction, from or to that vanity address so it lands in the target’s activity feed.
- Wait: Days or weeks later, the target opens their wallet, scrolls history, and copies the most familiar-looking recipient.
- Catch: Funds go to the attacker’s lookalike address. There’s no private-key compromise, just a perfect copy-paste trap.
What counts as state-invariant spam
A July 27, 2026 research paper on arXiv examined “state-invariant” transactions across Ethereum mainnet and major L2s. These are transactions that execute but don’t meaningfully change chain state. The paper measured nearly 1.4 billion such transactions across Ethereum, Optimism, and Base, and found that address-poisoning campaigns account for 53% of non-reverted state-invariant transactions on Ethereum (arXiv (There Will Be Spam)).
What We See On-Chain Right Now
The data backs up what many of us see in our own wallets: a rising tide of zero-value and dust entries meant to shape what we copy later. The arXiv study’s scale matters here: nearly 1.4 billion state-invariant transactions across three networks, with more than half of Ethereum’s non-reverted subset linked to poisoning campaigns (arXiv).
That doesn’t mean half of all Ethereum activity is poisoning. It means within this specific slice of no-effect transactions, poisoning dominates. L2s like Optimism and Base also show large volumes of state-invariant activity in the study period, consistent with cheap gas making spam experiments inexpensive.
Network Spam cost profile Common poison signal Notable study finding Source Ethereum Higher gas per tx Zero-value or dust entries matching edges of prior recipients 53% of non-reverted state-invariant tx tied to poisoning campaigns arXiv Optimism Low to moderate gas Frequent vanity lookalikes seeded in activity feeds Large-scale state-invariant activity observed arXiv Base Low gas Clumps of zero-value transfers after hype cycles Large-scale state-invariant activity observed arXiv
Why Ethereum shows up so strongly
Mainnet has a broader set of addresses and longer histories, which makes the “copy from last time” habit common. Attackers are selective. A few high-value targets justify the gas.
Cheap blockspace fuels experiments
On L2s, the cost to plant dozens of decoys is minimal. Even if the hit rate is tiny, campaigns can be profitable at scale. This is classic spam math.
User Habits That Create Openings
Poisoning works because it leans on our shortcuts. Most mistakes I hear about sound ordinary.
Copying from history by default
Instead of saving contacts, we scroll and reuse. That keeps the poisoned address front and center.
Trusting edge matches
Many UIs show only the first 4 and last 4. If both ends look right, we don’t stress the middle. Attackers design their vanity address to exploit this exact frame.
Doing it fast on mobile
Mobile apps shrink context. It’s easy to miss a label or a tiny “zero value” tag when you just need to get a transfer out the door.
Clipboard and cross-app friction
Any extra step increases the chance you paste the wrong thing or grab from the wrong screen. Poisoners count on the path of least resistance.