Address poisoning is a quiet way to drain a crypto wallet: a scammer plants a near-identical address in your transaction history and waits for you to copy it out of habit. For an everyday user, it's a rare, nasty surprise. For a crypto exchanger, it's a support ticket, a refund argument, and a reputation hit that was entirely avoidable.
What address poisoning actually is
The trick works because most people don't grab a payout address from a QR code or an address book — they copy the last similar-looking one from their own history. A scammer sends a near-zero or literally zero-value transfer to the victim's wallet from an address that matches the first and last 4-6 characters of a real, trusted address. That junk transaction sits quietly in the history, and next time the victim pays, they copy the fake line instead of the real one.
How the lookalike address gets made
There's no magic involved. Elliptic-curve wallet addresses can be generated by the millions per second on an ordinary GPU, cycling through combinations until one matches the target's first and last characters. Think of it like swapping the house-number plate on a building — if the mail carrier only checks the first and last digit, the swap goes unnoticed. The more characters that visually line up, the less reason the victim has to double-check.
Why this is really an exchanger problem
Picture a client who topped up through your USDT deposit address a month ago without a hitch. Today they skip the QR code and copy the address straight from their wallet history — except that line got poisoned by a zero-value transfer from a lookalike address. $800 disappears into the void, and the client opens a ticket demanding the money back from an exchanger that never received it. Technically you did nothing wrong. Practically, your support team burns hours on the case, and your name is the one in the angry forum post.
Spotting a poisoned address in the wild
- Check the whole address, not just the first and last characters — the human eye can't reliably do this, so use an address book or a QR code instead.
- Treat any unexpected zero-value or dust transaction in your history as a red flag — don't copy from that line, don't interact with it.
- Save verified addresses to a bookmark or address book rather than relying on "grab the last one."
- Favor wallets that visually distinguish saved, trusted addresses from new, unknown ones.
What actually helps: a checklist for exchanger owners
- Add a warning step in your support flow whenever a client's withdrawal address is new or changed.
- Train support staff to recognize "my funds never arrived" as a possible poisoning case, not just a standard payment dispute.
- Give clients a built-in address book inside your exchanger's wallet instead of "just copy it from your last transaction."
- Log dust transactions hitting client addresses as a security signal, not noise to ignore.
Conclusion
For the scammer, this attack costs almost nothing — one zero-value transfer and a bit of GPU time. For an exchanger, it costs something much harder to get back: client trust and hours of support work for a problem you didn't cause. The fix isn't paranoia, it's process — verified address books and breaking the habit of copying payment details blind. If you're running your own exchanger, a built-in iEXWallet with verified client addresses cuts down on these incidents without piling more work onto support.
