Address Poisoning - The address that was almost right

01 — The long waitThirteen months, one mistake

Sometime in late 2020, one Ethereum wallet started paying another. Over the following year 0xd674…a7da sent 48,235 ether across thirteen transactions, always to the same destination, 0x6d90cc8c…2e48. Then the payments stopped. For four years, nothing passed between them.

On 3 October 2025, a stranger sent that first wallet one ten-millionth of an ether. Not enough to buy anything. Not enough to notice.

The stranger's address was 0x6d9052b2…2e48. It started 0x6d90 and finished 2e48.

So did the address of the business partner. Everything in between was different.

Seven weeks later the stranger sent another sliver of a coin, a billionth this time. Then again on 29 January. On the morning of 30 January 2026, the owner of the first wallet went back to that dormant relationship and sent 4,556 ether. Ether closed that day at $2,731.82.

That is $12,446,182, paid to a stranger who had spent thirteen months positioning one line in somebody else's transaction history.

Thirty-two minutes and forty-eight seconds later the money was swept out in a single transaction to 0x49a21fc9…e9df. The dust payments started again three days after that, in case the owner tried a second time.

What happened to that wallet has a name. It is called address poisoning, and the reason we are writing about it is that the January theft was not unusual. It was the largest of 1,355 we found.

Bitquery indexes every transaction on Ethereum, so we went looking for the rest. Over the twelve months to 31 July 2026 we examined roughly 1.28 billion token and ether transfers, hunting the specific pattern that emptied that wallet: a fake address, matched at both ends to a real one, placed inside a victim's own transaction history and left to sit there. We found 45.5 million confirmed pairings — one fake address aimed at one wallet — hitting 6,922,366 wallets in total. Some 1,319 people sent real money to one of them, losing $22,261,415 between them.

This article is what that data says. How the attack is built and why one attempt costs an attacker $1.86. Who gets targeted, and the much smaller group who actually lose money. How long the bait waits in a wallet before somebody copies it, which turns out to be the number that decides what defences are worth building. Where the stolen funds go once they move. And what genuinely protects an ordinary user, as opposed to what the industry currently offers them.

It also covers something we got wrong. Our first pass at this analysis undercounted the losses by a factor of three, for a reason that applies to most published work on the subject.

02 — The premiseWhat address poisoning actually is

Everything above turns on a detail most people never think about: a cryptocurrency address is not readable.

An Ethereum address is forty hexadecimal characters. 0x and then something like 6d90cc8ce83b6d0acf634ed45d4bcc37eddd2e48. It is not a name or an account number you could recite. It carries no meaning, no checksum a human can eyeball, nothing that looks wrong when it is wrong.

So nobody reads it. Wallets show you the first few characters, an ellipsis, and the last few. Users check them the same way. Ends match, looks fine, send.

Address poisoning is the attack built on that habit. Produce an address that matches the ends, get it in front of the victim, and wait.

Producing one is not the hard part. Ethereum addresses are derived from randomly generated private keys, so an attacker generates keys in bulk until one produces an address starting and ending with the characters they want. Matching four characters at each end means searching about 4.3 billion candidates. On one consumer graphics card that takes roughly 43 seconds.

The harder part is delivery, and this is where the design of public blockchains works against the people using them. Your transaction history is not a private record your wallet keeps for you. It is a public ledger, and anybody can add a line to yours. Send you a fraction of a coin and you have a new entry. Publish a token contract that announces a transfer you never made and you have a new entry. Either way the attacker's address is now sitting in your history, next to real payments, looking like one of them.

03 — The measurementWhat we found across 1.28 billion transfers

We took every token and ether transfer on Ethereum for the twelve months to 31 July 2026 and looked for one specific pattern: a lookalike address entering a particular wallet's history, where that lookalike matched an address the wallet had genuinely paid before.

What matters is not that lookalikes exist, but that each one was aimed at a particular wallet.

That distinction is the whole method. Across all of Ethereum, two addresses sharing four characters at each end is unremarkable, because there are billions of addresses. Inside one person's list of counterparties, which usually runs to a few dozen, it is about a one in a million coincidence. So we only counted a match when it happened inside a single wallet's own history.

One wallet in 5,248 fell for it. That is not a sign the attack is failing. It is the reason the attack exists in this form.

An attempt costs about $1.86 in transaction fees. The forgery costs 43 seconds of electricity. Against a median theft of $336 and a maximum of $12.4 million, that arithmetic works at almost any hit rate. Those 45.5 million pairings were delivered in only 10.3 million transactions, because one transaction can carry hundreds of forged transfers at once: a single contract call we examined announced 145 of them. Across the year attackers spent roughly 6,937 ether, about $19.2 million, in fees on those transactions, and stole a measured $22.3 million. On the numbers we can prove, the whole business roughly breaks even. Our theft figure is a floor and their cost figure is not, so the real margin is wider than that.

04 — DeliveryTwo ways address poisoning reaches you

Most published analysis of address poisoning looks at one delivery method. There are two, and they are close to an even split.

The forged send. Anyone can deploy a token contract on Ethereum, and a token contract is the thing that announces its own transfers. A malicious one can announce a transfer that never happened, declaring that you sent money to an address you have never seen. You did nothing at all. Your wallet now shows an outgoing payment and, beside it, the attacker's address.

The good operators mirror a real payment you just made, to the decimal. On 9 August 2026, wallet 0xb83f1c98…f50e sent a 115.147641 USDT test transfer to check an address was right. Twelve seconds later a counterfeit contract announced an identical 115.147641 transfer to a lookalike. Thirteen minutes after that, the victim sent $39,889 to the wrong one.

Read that sequence again, because it inverts standard advice. The test transfer is what created the bait. You cannot mirror a payment that was never made.

The safety ritual is what creates the bait. You cannot mirror a payment that was never made.

9 August 2026 — twelve seconds between the real transfer and its forgery

The dust send. Cruder, and the method that took the $12.4 million. The lookalike simply sends the victim a worthless fragment of a coin, which lands in the history as an incoming payment and waits.

Half the problem lives in that second category. 671 of 1,355 thefts, 49.5 percent, are reachable only through incoming poison. Any analysis that looks only at what victims appear to have sent misses half the crime.

05 — The supply chainThe counterfeit currencies

Forged sends need convincing tokens, and there is now an industry supplying them. We catalogued 38,691 counterfeit contracts impersonating major currencies, responsible for 132.5 million transfers during the year.

The busiest is 0x647a139b…acb8, a fake Tether whose ticker reads USDT on any screen while having nothing to do with Tether. The first character is a Latin U with an acute accent, the second a Cyrillic Dze, the fourth a Cyrillic Te. Deployed on 15 June 2026, it reached 1,057,569 addresses in under two months.

Others are quieter about it. 0xe75ae445…e377 spells USDT correctly, and simply is not Tether. One counterfeit pads the ticker with six invisible zero-width spaces; another hides a formatting character inside the word; a fake USDC uses the Lisu script. Rendered in a wallet's activity list, they are indistinguishable from the real thing.

Put counterfeit tokens together with zero-value transfers, the other standard technique, and 198.5 million transfers in the year carried a poisoning signature. That is 15.45 percent of all token transfers on Ethereum.

Some of that is innocent. Legitimate contracts emit zero-value transfers for their own reasons, and some counterfeit traffic is ordinary scam airdropping rather than targeted poisoning. But better than one token transfer in seven now exists to mislead somebody.

06 — The blind spotThe vector almost everyone misses

Our first pass at this analysis was wrong by a factor of three. The reason is worth explaining, because it is the same mistake most published work on address poisoning makes.

We filtered to token transfers. That looked reasonable, since counterfeit tokens are the signature technique. But that filter cut out more than a method of attack. It cut out a method of payment. Every victim who sent plain ether to a lookalike disappeared from our totals.

Ether is the one asset on Ethereum nobody can fake. Token contracts announce their own transfers and can lie about them; ether transfers are recorded by the network itself. It is the safest thing on the chain to count, and it was the only thing we were not counting.

Ether turned out to be 63.5 percent of everything stolen, $14.1 million of it. And 439 thefts, close to a third of the total, are visible only through ether-dust poisoning. A study that filters on token transfers reports about a third of the problem, and misses the largest theft on the chain.

07 — The victimsWho loses, and how much

The median theft is $336. Sixty-four percent of victims lost less than $1,000.

The largest single theft is 55.9 percent of all money stolen.

Both of those describe the same twelve months, and quoting either one alone describes the wrong crime. Take the January theft out and the other 1,354 thefts, against 1,318 victims, account for $9.8 million between them. This is a high-volume crime against ordinary wallets with one catastrophic outlier sitting on top of it.

08 — The clockThe myth of the instant theft

The poisoning cases that get written up are fast. The $39,889 loss above took thirteen minutes. Most of it does not work that way.

This is the finding with the most practical weight, because it decides which defence is worth building. The industry's preferred fix is a warning at the moment of signing, a pop-up that interrupts the transaction. On this distribution that catches roughly one theft in eight. The poisoned entry usually sits in the victim's history for the better part of a week before anybody copies it.

Cleaning the history protects more people than interrupting the moment.

One qualifier. Poisoning is often reactive: in 21.6 percent of thefts the lookalike appeared within ten minutes of the victim's first genuine payment to the real address, and in 3.8 percent within a minute. Bots watch the chain and mint a matching forgery on the spot.

09 — The exitFollowing the money

Tracing stolen crypto is harder than it sounds, and there are two ways to get it wrong. Stop one step too early and the money vanishes into wallets with no name attached. Keep following blindly and you walk into a decentralised exchange, where the funds mix with everyone else's. Our first attempt did exactly that and produced a nonsense figure of $64.9 billion in apparent flow.

The rule that works is about scale, and it is the same logic behind money-flow tracing. A wallet built to receive one theft takes money from a median of three senders. An address taking money from more than a hundred is not a launderer, it is a service, and the trail ends there.

Of the money that reaches named venues, addresses labelled Bybit received $304,892, OKX $259,570, Revolut $57,267, Binance $38,706, Kraken $35,000 and Coinbase $2,200.

The January thief is worth following on its own. The wallet that received the 4,556 stolen ether did not sit on it. It pushed the ether out through 56 contract calls, decentralised exchange trades, and among what came back was 669,859 DAI.

That is a deliberate choice. Tether and Circle can freeze USDT and USDC at any address, permanently, on request. DAI has no such switch. Converting stolen funds into the one major dollar stablecoin whose issuer cannot claw it back is a rational answer to the only enforcement mechanism that exists on Ethereum.

10 — EnforcementThe one that got caught

That enforcement mechanism does work. Over twelve months, Tether blacklisted one of the 1,350 thief addresses we identified. When it moved it moved fast, 0.8 days after the theft.

Speed was never the constraint. The other 1,354 addresses were simply never touched.

11 — The operatorsNot a thousand criminals

Seven million targeted wallets and forty-one million forged addresses suggest a crowd. The funding says otherwise.

Poisoning wallets need ether to pay transaction fees, and that ether comes from somewhere. Seventy funding addresses paid the fees for more than one thief wallet. The four largest sit behind 530 of the 1,350 thief addresses in our data.

The August case makes the shape of it visible. Four counterfeit contracts raced for that victim inside fourteen minutes, which looks like four competing crews. The gas funding shows otherwise. Two of them, including 0x647a139b…acb8 which took the $39,889, and 0x5b40f9e4…2437, draw their fees from the same funding address. A third draws from another. So it was two operations, one of them running several counterfeit tokens at once. And that shared funder is among the four largest on the entire chain.

12 — DefenceHow to prevent address poisoning

Never copy an address out of your transaction history. It is the one field on your screen an attacker can write to. Keep addresses in an address book, a password manager, or anywhere the attacker cannot reach.

A test transfer creates the bait. Send one if you want the reassurance, but copy the destination from wherever you originally verified it, not from the record the test produced.

Check the middle. Every attack we found matched the first and last four characters, because grinding for more is not worth the electricity. Seventy-one percent matched exactly four and four. The lie always lives in the part nobody reads.

Treat your own exchange deposit address as the high-risk one. That is where 28.3 percent of these thefts land, a share we could only measure because those addresses carry Bitquery address labels.

An address you have not used in years is not safer. The January victim was going back to a partner from 2021. The attacker had been waiting since October.

If you build wallets: prune, do not warn. With a median of 5.8 days from bait to theft, hiding zero-value transfers, unverified tokens and dust from transaction history will protect more users than a pop-up at signing. Wallet and exchange teams can screen incoming transfers against address labels and risk scores before showing them to a user at all.

13 — MethodHow we did this

We examined every Ethereum transfer from 1 August 2025 to 31 July 2026 using Bitquery's full-history archive of the chain.

An attempt was counted only where a lookalike entered a specific victim's own transaction history and matched an address that victim had genuinely transacted with earlier, on at least four leading and four trailing characters, with the match tested inside that wallet's own set of counterparties rather than across the chain.

Because token contracts can announce transfers that never happened, only assets nobody can forge were allowed to establish a real business relationship or to count as a loss: genuine USDT, USDC, DAI, WETH, WBTC and native ether.

A theft required an unbroken chain of evidence. The lookalike entered through a poisoning transfer. The address it impersonated was a genuine counterparty first. The lookalike had never been used by that victim before. And real money followed.

The detection pipeline reproduces the known August case without being told about it. A 30-sample audit, re-derived from raw blockchain records rather than from the pipeline's own output, passed 30 of 30.

14 — EvidenceEvery address and transaction cited

Readers who want to check the work can paste any of these into a block explorer. We publish them as text rather than links because explorer coverage of older Ethereum history varies, and a link that returns an empty page is worse than no link at all.