Address Poisoning: How People Send Crypto to Exactly the Wrong Address
By NorwegianSpark Editorial — written with AI assistance and reviewed by the NorwegianSpark SA editorial team | Last updated: 2026-08-19
This article contains affiliate links. We may earn a commission at no extra cost to you. Full disclosure
There is a category of loss that involves no hack, no phishing site, no leaked seed phrase and no malicious contract. The user sent funds to an address they chose, deliberately, having checked it.
They checked it the way everybody checks it — the first few characters and the last few — and those matched. The forty characters in between did not.
Why nobody reads the whole address
An address is a long string of hexadecimal characters with no meaning, no checksum a human can perform, and no redundancy. Nobody can hold one in memory and nobody reads one in full.
So every interface abbreviates. Wallets, explorers and transaction histories all display something like the first six characters, an ellipsis, and the last four. Users learned to verify against that abbreviation, because it is what they are shown.
That habit is the vulnerability, and an attack was built specifically for it.
The attack
Address poisoning works by putting a lookalike address into your own transaction history, so that you copy it from there later.
The attacker generates an address whose first and last characters match one you have recently transacted with. That is computationally easy — matching the visible ends is a far smaller problem than matching the whole thing. Then they send a transaction involving your wallet from that address, often a zero-value or trivial transfer, purely so it appears in your history.
Later, you want to send to the same recipient again. You scroll back, find what looks like the right entry, copy the address, and send. The abbreviation matched because it was designed to.
A related variant is clipboard interference: malware on the device watches for something that looks like a crypto address being copied and substitutes its own. Same outcome, different mechanism, and the same defence defeats both.
Why it is final
Ethereum.org states the consequence without any hedging (ethereum.org/security): "A transaction sent on Ethereum is irreversible. Unless you know the address owner and can convince them to send you your fund back, you will not be able to retrieve your funds."
The same page gives the corresponding instruction: "Always make sure the address you are sending to exactly matches the desired recipient's address before sending a transaction."
The word doing the work there is exactly. Not the first four and the last four. Exactly.
There is no support line, no reversal, no chargeback and no authority with the power to undo it. The transaction was valid, signed by you, and executed as instructed. This is the same property that makes the system work without a trusted intermediary, and it is entirely unforgiving of exactly this mistake.
Defences, in order of how much they help
Never copy an address from your transaction history. This single habit defeats address poisoning completely, because the whole attack consists of putting a bad address into that history. Get the address from the source — the exchange's deposit page, the recipient's own message, your own saved contact.
Use the wallet's address book. Save an address once, verified properly, with a name. Then select the name rather than a string. Most wallets have this and most people never use it.
Send a small test transaction first. For any meaningful amount, to any address you have not used before, send a small amount and confirm it arrived before sending the rest. The cost is one transaction fee. The alternative cost is everything.
Verify the middle, not just the ends. If you must check a pasted address by eye, check characters from the middle as well. Attacks target what people look at.
Check what your hardware wallet's own screen says. A hardware device displays the destination on its own screen, outside the reach of malware on the computer. That display is the authoritative one — malware can change what the browser shows and cannot change what the device shows. If they differ, the device is right. See the crypto wallet security guide.
Confirm the network as well as the address. The same address format is used across several chains, and sending on the wrong network is a separate and equally common way to lose funds. The address can be perfect and the transaction still unrecoverable.
The related error: right address, wrong chain
Worth naming separately because it catches careful people.
Many chains share an address format, so a valid-looking address will accept a transaction on a network the recipient does not actually control there — or a network the receiving exchange does not credit. The address matched. The chain did not.
Exchanges publish which networks they accept for each asset, and that list is the thing to check, not just the address. Our guide to how to fund a crypto account covers the deposit side.
Frequently Asked Questions
Can a poisoned transaction in my history steal from me directly?
No. Appearing in your transaction history gives an attacker no access to anything. The entry is bait, and it only costs you something if you copy the address out of it and send funds yourself.
Can I get funds back if I send to the wrong address?
Effectively no. An on-chain transaction is irreversible, and recovery depends entirely on identifying the owner of the receiving address and persuading them to return it. If it was sent to an attacker's address, it is gone.
Does a hardware wallet prevent this?
It prevents the clipboard-substitution version, because the device shows the true destination on a screen malware cannot alter. It does not prevent you copying a poisoned address and confirming it deliberately — the device will faithfully display the wrong address you chose.
Is a small test transaction worth the fee?
For any amount whose loss would matter, yes, without hesitation. One fee buys certainty about address, network and recipient, and it is the only check that verifies all three at once.
The habit worth building
Treat every address as untrusted until it comes from a source you deliberately chose, and never from a list your wallet generated. Save the ones you use. Test before you commit.
None of this is technical and all of it is boring, which is precisely why it works — the attack depends entirely on a shortcut everybody takes, and declining to take it costs nothing.
Sources: the ethereum.org security guidance, read 19 August 2026.
Content on AICryptoCoin is for informational purposes only and does not constitute financial advice. Always do your own research and consult a qualified financial advisor before making investment decisions.