How the scam works
A wallet usually shows an address shortened to something like TXYZp1…q7aB. Generating an address whose first four and last four characters match a target takes a modern GPU minutes to hours, so attackers do it for thousands of active addresses — on TRON and Ethereum in particular, where USDT transfers are frequent. They then send a tiny amount of USDT, a fake token with the same ticker, or a zero-value transferFrom that appears in your history right next to the real counterparty.
Nothing is stolen at that point. The loss comes later, when you open your history, copy 'the address you paid last time' and send the next payment to the look-alike. A blockchain transfer cannot be reversed, and the poisoned address belongs to the attacker.
What the comparison checks
- Every character, not just the edges. Differences are highlighted in the address you are about to use.
- Matching prefix and suffix length — a match of 3+ characters at both ends with a different middle is reported as the poisoning pattern.
- Hidden characters: zero-width spaces, byte-order marks and line breaks that sometimes come with copy-paste from chats or documents.
- Non-ASCII look-alikes such as the Cyrillic а or о, which never appear in blockchain addresses.
- For EVM addresses, case-only differences (the same account) and whether the mixed-case version passes the EIP-55 checksum.
Habits that make poisoning useless
Take recipient addresses from the source: the invoice, the exchange's deposit page, the order page, or an address book entry you created after verifying it. Never copy from transaction history, and ignore unexpected incoming transfers of zero or dust amounts. When the amount matters, send a small test transaction first and ask the recipient to confirm it arrived. On a hardware wallet compare the full address shown on the device screen.
Swapping on KOT.CASH you paste your own payout address once per order, and the deposit address is shown on the order page — copy it from there, not from an old transaction in your wallet.
Frequently asked questions
+I received 0 USDT from an unknown address. Am I hacked?
No. Zero-value or dust transfers are the bait of address poisoning; they do not give anyone access to your wallet. Do not interact with them and never copy that address.
+Can I get my money back after sending to a poisoned address?
Usually not: the address belongs to the attacker. For USDT you can contact Tether and the receiving exchange quickly with the hash; freezes are rare and not guaranteed.
+Why do two EVM addresses look different but count as equal here?
EVM addresses are case-insensitive. Upper and lower case encode the EIP-55 checksum, so 0xAbC… and 0xabc… are the same account.
+Does this tool send the addresses anywhere?
No. The comparison runs locally in your browser; addresses are public anyway, but nothing you type leaves the page.
+Which networks are affected?
Any network where addresses are long strings: TRON, Ethereum and other EVM chains, Solana, Bitcoin. It is most common where USDT transfers are frequent.
Calculations run entirely in your browser; nothing you type is sent to KOT.CASH. Results are estimates for information only and are not financial, tax or legal advice.