Address Poisoning: The Copy-Paste Trap

An attack that breaks nothing. No stolen keys, no malicious contract, no signature you did not mean to give. It targets a habit every wallet interface has trained into you, and in one case, it took $50 million in under an hour. Part of Know the Scam by SimpleSwap.

Crypto addresses are 42-character hexadecimal strings that are meaningless and hard to remember. That is why most interfaces truncate them: the first four characters, an ellipsis, and the last four. People read the ends; the middle is ignored.

Address poisoning is the discovery that this display convention is an attack surface.

Researchers at Carnegie Mellon documented 270 million poisoning attempts across Ethereum and BNB Chain between July 2022 and June 2024, aimed at 17 million unique wallets, with confirmed losses above $83 million. Their conclusion was blunt: this is quietly one of the largest phishing operations running on public blockchains.

How it works

Four steps, each individually harmless.

1. The attacker picks a target. Bots continuously monitor the chain for wallets with regular activity, especially those moving large stablecoin balances. Dormant wallets are not worth the gas.

2. They generate a lookalike. GPU-powered vanity address generators produce thousands of candidate addresses per second until one matches the target’s first few and last few characters. In the December 2025 case, the fake matched the first three and last four hex characters, seven fixed positions in total. Truncated in any wallet interface, the two addresses are identical.

3. They plant it in your history. The attacker sends a tiny or zero-value transfer from the lookalike address to you. That dust does nothing except add the fake address to your transaction list, sitting among the addresses you actually use, looking exactly like one of them.

4. They wait. The next time you send funds and reach for your history rather than your address book, the trap either works or it does not. No further action is required from the attacker.

Nothing is hacked at any point. The resulting transaction is valid, signed by the rightful owner, and executed exactly as instructed. It simply goes to the wrong place, and no exchange or swap service can reverse it.

The case that should change how you send

On December 20, 2025, a trader lost 49,999,950 USDT, close to $50 million, to a poisoned address. The whole thing took under an hour, and the funds were converted to ETH, split across wallets, and partially routed through a mixer.

Read the sequence carefully, because it is the reason this article exists.

The victim did the thing everyone recommends. They first sent a 50 USDT test transaction to the correct address, and it arrived successfully. Watching the chain, the attacker then pushed a 0.005 USDT dust transfer from a lookalike address into the victim’s history, landing it immediately after the successful test. Minutes later, the victim copied from that history for the real transfer, and 49,999,950 USDT went to the attacker.

The victim later offered a $1 million white-hat bounty for the return of the funds. It went unanswered.

So the standard advice is not wrong, but it is dangerously incomplete. A test transaction verifies the address. It does not protect the gap between the test and the real send, and that gap is precisely where the poison arrives.

In January 2026, the same pattern took 4,556 ETH, roughly $12.25 million, from another holder.

Why 2026 made this worse

The economics were always absurd. A May 2024 victim lost $68 million in wrapped Bitcoin to an attack that cost the scammer about $0.65 in gas.

But at scale, the dust transfers added up. Then Ethereum’s Fusaka upgrade landed in December 2025, cutting fees by roughly six times. Good for users, it removed the last cost barrier to mass poisoning overnight.

The numbers changed fast. Poisoning attempts went from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x jump in two months. One attacker contract sent three million dust transfers to over a million addresses for a total cost of $5,175.

The prevention checklist

Ordered by how much each one actually does.

Never copy an address from transaction history. This is the whole attack. History is a log of what happened, not a list of addresses you trust. Treat it as read-only.

Keep a real address book. Save addresses you use repeatedly in your wallet’s contacts or whitelist, entered once from a source you control. Then select from there every time. This removes the decision entirely, which is better than remembering to be careful.

Verify the middle, not just the ends. If you are checking manually, the first and last four characters are exactly what the attacker matched. Compare a run of characters from the center, or better, compare the full string.

Re-enter the address for the real transfer, not just the test. The $50 million case turned on this. If you send a test, go back to your trusted source for the main transaction rather than reusing anything from history.

Use ENS or a domain name where available. A human-readable name removes the character-matching problem at its root, though you should still confirm the name resolves to the address you expect.

Ignore unexpected dust. Small, unrequested transfers are not free money or a glitch. They are usually bait, and the correct response is to leave them alone and never interact with the sender.

Slow down on large transfers. The victims in these cases were not careless people. They were moving large sums using a workflow that is fine ninety-nine times and catastrophic once.

Where this meets your swap

This is the one attack on our map that lands squarely inside our own flow, and it would be dishonest to present it otherwise.

Every SimpleSwap exchange asks you for a receiving address. That is the moment address poisoning targets. We generate the deposit address you send to, but the address your converted funds arrive at is one you provide, and if it is poisoned, the transfer is valid, final and unrecoverable. No exchange can undo a correctly executed transaction to a wrong destination.

So the check belongs to you, and it is a short one: paste from your own wallet or address book rather than from any transaction list, then compare the middle of the string, not just the ends. If the swap is large, do it twice before confirming.

It is worth being just as attentive to the deposit address we show you. That address cannot be poisoned the way a receiving address in your history can, but a phishing page or a copy-paste slip can still hand you the wrong one. Copy it from the order page itself and paste it directly into your wallet. Anything that arrives via chat, email, or a search result is not from us, and our only official domain is simpleswap.io.

What comes next

Each entry above will get its own breakdown in “Know the Scam by SimpleSwap” over the coming months. Follow #KnowTheScam to catch every new one as it drops — phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.