Address poisoning: how $415,136 went to lookalike addresses in two weeks, and a 60-second pre-send check

Published 2026-10-19 · Updated 2026-10-19

Recent losses (Sep 25 – Oct 7, 2026)

Each case was reported by the anti-scam firm Scam Sniffer on X. We copied the amounts and addresses exactly from its posts. Times are UTC. The four cases add up to $415,136 (our sum).

All four were on Ethereum and all involved stablecoins. In each pair, the first 3–4 characters after 0x and the last 6 characters match exactly (we checked each pair). Scam Sniffer noted that in the Oct 7 case "the first 4 and last 6 characters match." (Scam Sniffer) A wallet that shortens addresses to something like 0xbc3a…5f4686 shows the real and fake versions identically.

[Uncertain: these are the cases one firm chose to post. They are a sample, not a total of all poisoning losses.]

How the scam works

1. You make a normal transfer. Scammers' software watches transfers of certain tokens, usually stablecoins. (MetaMask)
2. They make a lookalike address. They use a "vanity" address generator to create one that matches the first and last few characters of yours or of the person you paid. (MetaMask; Etherscan)
3. They plant it in your history. They send a tiny or zero-value transfer from the lookalike, so it shows up in your history. Etherscan also documents two variants: fake tokens named like USDT ("token spoofing") and forged transfer events ("event spoofing"). (Etherscan)
4. You copy the wrong one. Next time, you copy "the address you used last time" from history and paste the fake one.

The planted transfer alone does not compromise your wallet. MetaMask says it "doesn't actually have any negative impacts in itself." The loss happens only if you send to the lookalike. (MetaMask)

The 60-second pre-send check

1. Get the address from the source, never from history. That means the recipient, the exchange's deposit screen, or your own wallet's receive screen. MetaMask says to avoid copying from transaction history, even for your own addresses. (MetaMask)
2. Check the middle characters, not just the start and end. Those are the ones a poisoned address is built to disguise. (MetaMask)
3. Use an address book. Save addresses you've verified (in MetaMask: menu, then Contacts) and send from there. (MetaMask)
4. Confirm on a hardware wallet screen. Most hardware wallets show the destination address on the device itself, which gives you one more chance to catch it. (MetaMask)
5. Read the wallet's warning. MetaMask now shows a blocking warning when a destination closely resembles an address you've used before, and a separate alert for a never-used address. Don't click past it. (MetaMask)
6. Big amount? Send a small test first, then confirm with the recipient through a different channel. [Our recommendation, not from a cited source. If you do a test, copy the address from the source again for the main send, not from history, because scammers react to transfers.]

If you already sent to a poisoned address

• Report it at ic3.gov. Include the transaction hash and both addresses. (IC3 lists what to include in crypto complaints.)
• If it was a stablecoin, contact the issuer quickly. Issuers have frozen funds tied to thefts: Tether froze $10 million in USDT linked to the Ledger implant thefts. (CoinDesk) [Uncertain: whether an issuer will freeze funds in any given case is its decision.]
• Ignore anyone offering to "recover" the funds for a fee. The FBI says these are often scams. (FBI)

No affiliate links on this page, by policy.

Sources

1. MetaMask Help Center, "Address poisoning scams." support.metamask.io (read 2026-10-19)
2. Etherscan Information Center, "Address Poisoning Attacks." info.etherscan.com (read 2026-10-19)
3. Scam Sniffer posts on X: Sep 25, Oct 3, Oct 6 and Oct 7, 2026 (linked in the table; read 2026-10-19 via the X API)

Changelog

• 2026-10-19: First published with 4 cases from Sep 25 to Oct 7, 2026.