Address poisoning: how scammers steal your USDT with a single "dust" entry in your transaction history and how to protect yourself

What is address poisoning

An Ethereum address is 0x followed by 40 more characters, and a TRON address is 34 characters starting with T. Nobody can memorize that, so wallets show addresses in shortened form, like 0x7a3f…c91e, and people check them by the first and last few characters. Address poisoning is built on exactly that habit.

The scammer generates a look-alike address: the first and last characters match an address you actually use, while the middle is different. GPUs churn through millions of keys until one fits, and matching five or six characters at each end takes only minutes. The scammer then makes sure the look-alike lands in your transaction history right next to the real address. After that, they simply wait for the day you copy the address from the wrong place.

People copy addresses every day: to pay contractors, deposit to a trading platform, top up a second wallet or swap coins on a crypto exchange. That makes anyone who regularly sends to the same addresses a target. Keep in mind that nothing gets hacked here: your wallet and seed phrase stay safe unless you send the money to the look-alike yourself.

Most attacks happen where USDT moves: on Ethereum, TRON and BNB Chain. These are the most popular networks for stablecoins, where people pay, keep savings and move USDT from ERC20 to TRC20 to cut fees. The more transfers there are, the better the scammer's odds that someone copies the wrong address.

How it looks in your wallet

The look-alike gets into your history in one of three ways, and all three look harmless.

Zero-value transfer

Many token contracts, USDT included, let anyone trigger a transfer of zero tokens "from your address" without your signature. You lose no money, but a line appears in your history as if you had sent 0 USDT to the look-alike address. This is the sneakiest version, because the entry looks like your own outgoing transfer.

Dust

Someone sends you a tiny amount of a real coin from the look-alike address, a fraction of a cent. An incoming transfer from a "familiar" address shows up in your history, and at a quick glance you can't tell it from the real one.

Fake token

The scammer creates their own token named USDT and sends you exactly the amount you recently transferred. Now your history has two identical lines: "100 USDT" to the real address and "100 USDT" from the look-alike. The only difference is the token contract, which wallets usually don't show. Genuine USDT has a single contract on each network, and you can check it on our page about USDT and the networks it's issued on.

Scam bots watch large wallets and react within minutes. Their favorite moment comes right after a test transfer: the person has just checked the address with a small amount and is about to send the main one.

How widespread it is

Address poisoning has long been one of the most common forms of crypto phishing. Researchers at Carnegie Mellon University tracked Ethereum and BNB Chain for two years and counted 270 million such attacks on 17 million victims. Confirmed losses reached at least $83.8 million across 6,633 cases, and the researchers found 13 times more attempts than had been known before. The paper was presented at USENIX Security in 2025.

Blockaid, a company that builds wallet security tools, has more recent figures:

The jump in early 2026 came from cheaper Ethereum. The Fusaka upgrade on December 3, 2025 cut fees roughly sixfold, and sending zero-value transfers and dust became almost free. According to Blockaid, by January 2026 Ethereum had overtaken BNB Chain as the most "poisoned" network. Similar campaigns are running on Solana, Arbitrum and Optimism. The cheaper the network, the cheaper the spam.

The $50 million case: a test transfer didn't help

On December 20, 2025, the owner of a wallet he had used for about two years, mostly for USDT, withdrew a large sum from Binance. At 03:06 UTC he sent a 50 USDT test to the right address, and it arrived.

While he was checking the test, the scammer's bot spotted the transfer, generated a look-alike with the same first five and last four characters and planted it in his history. At 03:32, 26 minutes after the test, the owner sent 49,999,950 USDT, copying the address from his history. The address belonged to someone else.

The rest took half an hour. The scammer swapped the USDT for DAI so Tether had no time to freeze the coins, then for ether, about 16,690 ETH, and sent almost all of it to the Tornado Cash mixer. The victim offered a $1 million bounty for the return of 98% of the funds. A similar $71 million case in May 2024 ended with nearly all the money returned after negotiations, but that is a rare exception.

The lesson is an unpleasant one: a test transfer verifies the address, but it doesn't protect you from poisoning. If anything, a look-alike is almost certain to appear in your history after the test, so the main amount should go to an address copied fresh from the source.

How to protect yourself from address poisoning

The rules are simple, but they only work if you follow them every single time:

1. Don't copy the address from your transaction history. Take it from the original source: the "Receive" screen in the recipient's wallet, a QR code, a message you know for sure came from the recipient, or your own address book.
2. Set up an address book. Save the addresses you use regularly in your wallet under clear names, and turn on withdrawal address whitelisting on your exchange if it offers one.
3. Check the whole address, or at least the middle. A look-alike matches at the edges, so check 4–6 characters in the middle of the address, or better yet, the entire address.
4. Copy the address again after a test transfer. Not from your history, but from the same source you used for the test.
5. Hide small amounts and spam. Many wallets can hide zero-value transfers, dust and unknown tokens. Turn that filter on, and the look-alike simply won't catch your eye.
6. Leave tokens you were sent alone. Don't try to sell an unknown "USDT" or "claim" it on a website listed in its description: that is a different trap, where you're asked to approve spending from your wallet.
7. On a hardware wallet, compare the address with the source. The device will faithfully show whatever address you pasted, look-alike included. Its screen protects you from malware on your computer, but not from a copying mistake.

A final check after pasting the address also catches a related attack. Clipper malware swaps the address right in your clipboard: you copy your own, and someone else's gets pasted. Checking the middle of the address before sending protects you from both schemes.

If you're moving to new addresses right now, for example after Europol's warning about the quantum threat to crypto keys, be especially careful: a new address is easy to mix up, and scammers are watching for exactly these large transfers.

What to do if you've been poisoned or already sent the money

A transfer you don't recognize appeared in your history. Your money is safe and your keys haven't been stolen. Don't reply and don't send anything to that address. Hide the transfer or mark the address as suspicious if your wallet supports it.

The money has already gone to the look-alike address. A blockchain transfer can't be reversed, but the first few hours matter a lot:

• find the transaction hash and save it, since it is your main piece of evidence; we explained how in our guide on how to check a transaction by TXID;
• file a police report: Tether and Circle usually freeze coins at the request of law enforcement, and as long as the scammer hasn't swapped the USDT, there is a chance;
• contact the support teams of major exchanges where the money might end up, with the scammer's address and the hash;
• don't pay "recovery services" that reach out to you on their own and ask for an upfront fee: that is a second wave of the same scam.

This situation is different from sending crypto to the wrong network: there, the coins usually sit at an address someone holds the keys to, and sometimes they can be recovered. Here, the money goes straight to the scammer.

How to exchange USDT safely without registration

An exchange involves two addresses, and each has its own rule. Copy the address you send coins to from the page of your current exchange, not from the history of past transfers. Take the address where you'll receive coins from the "Receive" screen of your own wallet, and check the middle after pasting it.

With VertEXchange, an exchange starts without an account, email or phone number. You choose a pair, paste your wallet address and see the rate, the final amount and the receiving address before you send anything, so you can check everything calmly, without rushing.

• A fixed rate holds for about 15 minutes, which gives you time to double-check the address without worrying that the amount will change.
• VertEXchange doesn't hold your coins: they go straight to your address.
• If the exchange doesn't go through, the coins are returned to your refund address.
• Personal fields of an operation are deleted 24 hours after it is completed, and your exchange history stays only in your browser.
• Questions are handled by the support chat on every page, using your exchange code.

USDT is what people exchange with us most often. For example, you can buy bitcoin with USDT TRC20 without registration: paste your bitcoin address, check it and see the final amount before you send.

FAQ

What is address poisoning in crypto?

A scammer creates an address that matches your usual one by its first and last characters and plants it in your wallet history with a zero-value transfer, dust or a fake token. The bet is that you'll copy the address from your history and send the money to them.

Can someone steal my money if an unknown transfer shows up in my history?

No. The entry itself doesn't take anything, and your keys stay with you. The only danger is that you copy the look-alike address and send money to it yourself.

Why is there a 0 USDT transaction in my wallet that I didn't send?

In the USDT contract and many other token contracts, anyone can trigger a transfer of zero tokens in your name without your signature. That is zero-value poisoning: the entry is there to make the look-alike address seem like one you've already sent money to.

Does a test transaction protect against address poisoning?

No. A test confirms the address is correct, but right after it a bot can plant a look-alike in your history. Send the main amount to an address copied fresh from the source.

Can I get my USDT back after address poisoning?

Rarely. There is a chance if the scammer hasn't swapped the USDT yet: then the issuer can freeze the coins at the request of the police. That's why you should file a report right away, with the transaction hash and the scammer's address.

Which networks does address poisoning happen on?

Most often on Ethereum, BNB Chain and TRON, where a lot of USDT moves. Campaigns also run on Solana, Arbitrum and Optimism. The lower a network's fees, the more spam there is.

How do I check a wallet address before sending crypto?

Copy the address from the original source, and after pasting it, check the whole thing or at least 4–6 characters from the middle. The beginning and the end of a look-alike match on purpose.