Address Poisoning Scam: How Look-Alike Addresses Steal USDT

Address poisoning is a scam in which an attacker sends a tiny or zero-value transfer to your wallet from an address that looks like one you use — same first and last characters, different middle. The fake address then sits in your transaction history. Next time you copy “the usual” address from that history, you copy the attacker’s instead and send real money to them. Nothing is hacked: no key is stolen, no approval is signed. The whole attack relies on people checking only the edges of a 34- or 42-character string.

How the attack works, step by step

1. The attacker watches public transfers of stablecoins on TRON, Ethereum, BNB Smart Chain and similar networks, looking for wallets that regularly send to the same counterparty.
2. Software generates a vanity address whose first 4–6 and last 4–6 characters match that counterparty. Matching six characters at each end takes a few hours of GPU time, so this is cheap.
3. The attacker makes the fake address appear in your history: a dust payment of 0.01 USDT, a transfer of a fake token named “USDT”, or a 0-amount call of the real token’s transferFrom, which some token contracts allow and explorers display as a transfer from you.
4. Your wallet lists the entry next to your real payments. When you open the history and tap the recent recipient, the look-alike is right there.
5. You send a large amount. The transfer is final, and the funds are usually moved through several addresses within minutes.

On TRON the fake transfers often look like ordinary USDT movements of 1–5 USDT, because sending dust there costs the attacker a few cents of energy. On Ethereum, zero-value transferFrom entries were common in 2023–2024; they appear even though you never signed anything, which surprises many people.

Signs that an address in your history is poisoned

• A transfer you do not remember, usually of a very small amount, appearing minutes after one of your real payments.
• A counterparty that seems to appear twice in your history with the same beginning and end.
• A token with the right ticker but a different contract address, or a token your wallet marks as unverified.
• An outgoing transfer of 0 tokens “from you” that you never made. On Ethereum this is the zero-value transferFrom pattern; it does not move your money but it plants the address.

How to copy addresses so poisoning cannot work

The fix is a habit, not software. The attacker can only win if you take the address from a place they can write into, and your transaction history is exactly such a place: anyone can send you a transfer.

1. Keep counterparties in your wallet’s address book or contact list, named and saved once from a trusted source. Send only from there.
2. For a new or rarely used recipient, get the address from them directly, over a second channel you trust, and save it.
3. Before sending, compare the whole address, or at least the first six, the last six and a chunk in the middle. The address poisoning checker highlights every differing character between the address you are about to use and the one you have on record.
4. For large amounts, send a test transaction first and ask the recipient to confirm it arrived. A poisoned address breaks this loop because the recipient never sees the test.
5. Hide or ignore tiny incoming transfers. Many wallets can filter transfers under a threshold or tokens without a verified contract.

Why exchanges and swap services are a common target

People paying the same exchange deposit address every week are ideal targets, because the address is reused and the amounts are predictable. On a swap service such as KOT.CASH every order gets its own deposit address, shown on the order page together with the amount and, where needed, a memo. Copy it from the order page each time instead of reusing an old deposit from your history — an old address can belong to an expired order anyway. The payout goes to an address you paste into the form, so the same rule applies: take it from your own wallet’s receive screen, not from a list of past transfers.

If you already sent funds to a poisoned address

1. Find the transaction hash and save it with the time, amount and both addresses. How to check a transaction by hash explains where to find it.
2. If the funds were USDT or USDC, write to the issuer’s support and to the exchanges the funds moved to. Tether and Circle can freeze addresses at the request of law enforcement, and some recoveries in poisoning cases happened that way. See can Tether freeze USDT.
3. Report it: in the US to the FBI’s IC3 (ic3.gov), in the UK to Action Fraud, elsewhere to the police cyber-crime unit. A police reference number is what exchanges and issuers ask for.
4. Ignore anyone who contacts you offering to get the money back for a fee. That is a second scam — see crypto recovery scams.

Address poisoning is not limited to stablecoins. It has been used against holders of wrapped bitcoin and ETH on Ethereum, and the largest reported cases ran into tens of millions of dollars. The size of the loss depends only on the size of the transfer, which is why the address-book habit matters more for large holders.