Address poisoning is a category of attack in which a malicious actor interferes with the address you intend to send funds to, causing your transaction to arrive at an attacker-controlled wallet instead. These attacks have resulted in significant losses across multiple blockchains. Understanding how they work is the first step to protecting yourself.
What Is Address Poisoning?
In its most common form, address poisoning exploits how users copy and paste wallet addresses. An attacker either modifies your clipboard using malware, or sends tiny "dust" transactions from a lookalike address that appears in your transaction history. The attacker's address is crafted to match the first and last several characters of a legitimate address, hoping you will copy it from your history without verifying the full string.
How Attackers Exploit Copy-Paste Workflows
The two primary attack vectors are:
Clipboard hijacking malware: Software installed on your device intercepts clipboard content and silently replaces a copied wallet address with an attacker-controlled one that visually resembles it.
Transaction history poisoning: The attacker sends a zero-value or dust transaction to your wallet from an address that closely matches an address you have previously interacted with, then waits for you to copy it from your history.
Phishing pages: Fake exchange or wallet sites that display modified addresses designed to look legitimate at first glance.
Why Partial Address Verification Is Not Enough
Many users verify only the first four and last four characters of an address, assuming the middle characters are effectively random. Attackers have automated tools that generate vanity addresses matching those partial strings. A Bitcoin address beginning with bc1q...ab3f where you only check the first and last segment can be trivially replicated by someone with sufficient computing resources. Full address verification is the only reliable protection.
How to Verify an Address Correctly
Follow these verification practices every time you send funds:
Compare the entire address character by character, not just the beginning and end.
Use QR code scanning where available — a QR code encodes the full address and cannot be partially spoofed the same way text can.
Verify the address on the original source — the wallet software, the exchange interface, or the confirmed communication — rather than from clipboard or transaction history.
After pasting an address, clear your clipboard and paste again to confirm it has not changed.
Never copy addresses from emails, chat messages, or social media posts without independent verification.
Protecting Your Device from Clipboard Malware
Clipboard hijacking malware typically arrives via malicious software downloads, browser extensions, or phishing links. Keep your operating system and software up to date, use reputable antivirus or endpoint protection, and be cautious about what browser extensions you install. Consider using a dedicated device for cryptocurrency transactions if you manage significant amounts.
Best Practices Summary
A quick reference checklist before every transaction:
Always verify the full address — never rely on first/last characters only
Use QR codes when possible
Source addresses from verified communications only
Keep devices free from unverified software and extensions
Double-check the address displayed in the confirmation screen of your wallet
Treat any address that arrived via a new or unexpected channel as suspect until independently confirmed
Cryptocurrency transactions are irreversible. There is no support team or bank that can reverse a transfer sent to a wrong address. A few extra seconds of address verification can prevent permanent financial loss.