SimpleSwap

Address Poisoning: The Copy-Paste Trap

Address poisoning is a crypto scam that places a lookalike wallet address in your transaction history, hoping you will copy it the next time you send funds.

How address poisoning works

Real address
Lookalike appears in history
Wrong address copied
Funds go to attacker

Attackers pick their targets first: bots watch the chain for wallets with regular activity, especially ones moving large stablecoin balances. A dormant wallet is not worth the gas.

  1. 1

    A lookalike is created

    The attacker generates an address that resembles one you have used before, often matching characters at the beginning and end.

  2. 2

    It appears in your history

    A tiny or zero-value transaction places the lookalike among your previous transactions.

  3. 3

    The trap waits for copy-paste

    If you later copy that address from transaction history, your next transfer can go to the attacker.

The case that should change how you send

In December 2025, a trader sent a $50 test transfer to the correct address – it arrived safely. Minutes later, the attacker planted a lookalike address in the trader's history, right after the successful test. The trader then copied from history for the real transfer: $49,999,950 went to the attacker instead. A $1 million bounty for the funds' return went unanswered.

The test transaction verified the address. It did nothing to protect the gap between the test and the real send – and that gap is exactly where the poison arrives.

It was not a one-off: a near-identical attack took $12.25M from another holder the following month.

The attack costs the attacker almost nothing. That is what makes it scale.

270M

poisoning attempts documented across Ethereum and BNB Chain (2022–24)

$83M

in confirmed losses from that same study

5.5×

jump in poisoning attempts in two months after network fees dropped

“One contract poisoned over a million addresses for about five thousand dollars, and a single hit has paid eight figures. You don't need a good success rate. You need a wide net.”
Rick CramerRick Cramer, Head of Analytics, SimpleSwap

How to avoid the copy-paste trap

  • Never copy an address from transaction history. Treat it as read-only.
  • Keep a real address book – save addresses once from a source you control, then select from there every time.
  • Verify the middle, not just the ends. Attackers match exactly the characters a truncated address shows you.
  • Re-enter the address for the real transfer, not just the test – the $50M case turned on this gap.

A saved address book defends against this specifically – it does nothing against clipboard hijackers, malware that swaps the address after you've already copied a correct one.

The one attack that lands inside our own flow

Every SimpleSwap exchange asks you for a receiving address. If that address is poisoned, the transfer is valid and final – no exchange can undo a correctly executed transaction to the wrong destination.

Two different addresses, two different checks. The address your swapped funds land on is yours to verify – use your own trusted source, never transaction history. The deposit address we show you can't be poisoned the same way, but a phishing page or a copy-paste slip can still swap it: copy it directly from the SimpleSwap order page, not from chat, email or a search result.

Want the full breakdown?

Read the full guide for real cases, how attackers generate lookalike addresses, why test transfers have limits, and a deeper prevention checklist.

Key takeaways

  • Check the address actually sitting in the recipient field – not the one you think you copied.
  • Compare the middle of the string, not just the first and last characters.
  • A successful test transfer doesn't protect the next one – that gap is exactly where poisoning arrives.
  • No exchange can undo a correctly executed transfer sent to the wrong address.

Address Poisoning FAQ

It may be address-poisoning bait intended to place a lookalike address in your transaction history. An unexpected small transfer does not itself give the sender access to your wallet – the danger is copying the wrong address later.

Only partially, and the largest recorded case proves the limit. The victim's test went to the correct address, then the attacker poisoned the history in the minutes that followed. Send the test if you like, but re-enter the address from your trusted source for the real transfer.

No. Lookalike addresses can be generated specifically to match visible characters at the beginning and end. Compare the destination with a trusted source before sending.

No exchange can be, and that's worth stating plainly. Every swap asks you for a receiving address, and if the address you paste has been poisoned, the transfer is valid and final – nothing on our side can detect that the destination isn't the one you meant. Paste from your own wallet or address book rather than any transaction history, and copy our deposit address directly from the order page.

For a standard swap, yes – SimpleSwap doesn't hold a permanent balance between transactions, and there's no wallet connection or approval to grant. The one thing no exchange can protect against is the address you paste in: if it's already been poisoned, a transfer to it is valid and final, which is why the destination always matters more than which service sends it.