Address Poisoning: How $68M Is Stolen in a Single Transaction

Using real blockchain data, we break down one of the most common schemes of 2024–2026: how a fraudster obtains a lookalike address, how they slip it into your history, and how, in the end, you send them the money yourself.

▶ Video breakdown of the scheme on a real transaction (English narration).

Where it all begins: the "empty" transaction

On 3 May 2024, an utterly unremarkable transaction 0x87c6e5…bf73 appeared on the Ethereum blockchain. Zero ether, a $0.63 fee. It was precisely this transaction that became the first step in the theft of 1,155 WBTC — about $68M. Let's open it in the explorer.

Transaction breakdown on a blockchain explorer

A real poisoning transaction. Open the original →

The analyst's first question: why pay a fee to transfer zero? An honest transaction always has an economic point. This one has none — which means the point is in something else.

Step 1. The fraudster creates a lookalike address

A wallet address is derived from a secret key. The fraudster runs a generator that produces millions of keys per second and checks: does the resulting address match, by its first and last characters, an address the victim frequently uses? Sooner or later a match is found.

The full mechanism of the scheme.

In our case the lookalike is 0xd9A1C3788D81257612E2581A6ea0aDa244853a91. Note: it begins with 0xd9A1 and ends with 853a91 — exactly like the real recipient's address. The middle cannot be forged, but usually no one looks at it.

Why this works. Wallets and explorers display the address in shortened form — 0xd9A1…853a91. A person checks only the beginning and the end. The entire deception is built on this.

Step 2. The lookalike gets into your history

The fraudster sends a transaction to you from the lookalike — of 0 coins or a fake token worth $0 (this is exactly 0x87c6e5…bf73). No money moves, but the record remains forever in your wallet's history, wedged in between real transfers. It cannot be canceled or deleted — the blockchain is immutable.

Sometimes, instead of "zero," they send a fake token with a visible amount or a spam token — we have seen such in the Token transfers tab (scam tokens with an absurd supply). The mechanism is the same: the goal is to get into your history.

Step 3. The moment of the theft

The next time you want to repeat a transfer to "the same recipient," you open the history and copy the address from there. Your eye catches the familiar d9A1…853a91 — and you copy the lookalike. The money goes to the fraudster irretrievably.

In the May case, the victim sent 1,155 WBTC this way. The money was recovered only because the fraudster agreed to negotiate — this is an extremely rare exception, not the rule.

How to protect yourself — in practice

Never copy an address from the transaction history.Only from your own address book or from a verified source.
Check the address in full, not the first/last 4–6 characters.Especially the middle — it is exactly the part that cannot be forged.
Make a test transfer of a small amount before a large one.
Check the recipient's address in an AML service.Known lookalikes are already flagged as Fake_Phishing.
Enable the "address book" in your wallet and label verified addresses.

Conclusion. Address poisoning does not break the blockchain and does not steal your keys — it exploits the human habit of checking an address "by its edges." The single habit of checking an address in full protects you from losing your whole wallet.

← Programme Programme →

All screenshots are real (eth.blockscout.com), the data is from the May 2024 incident. The materials are for educational purposes.