Address poisoning and dust transactions: how they trick your transaction history

07 October 2026

Address poisoning and dust transactions are scams that exploit your wallet's transaction history to make you accidentally send funds to a scammer's address. The attacker sends tiny amounts of cryptocurrency (dust) from an address that closely resembles one you have used before, hoping you will copy that poisoned address from your history instead of the real one.

How address poisoning works

The scam relies on two things: the way most wallets display transaction histories, and the fact that people often copy addresses from past transactions rather than requesting a fresh one.

1. The attacker monitors public blockchains for active wallets and identifies addresses you have sent funds to.
2. They generate a "vanity address" that matches the beginning and end of a legitimate address you have used. For example, if you regularly send to 0xAbC...1234, they create 0xAbC...12H4 (different ending characters, but similar enough at a glance).
3. They send a tiny amount of cryptocurrency - often near-zero value - from that fake address to your wallet. This creates a transaction record in your history.
4. The next time you need to send funds to the legitimate address, you scroll through your history, see the fake one, and copy it by mistake.

The dust amount is deliberately small. Many wallets do not display transactions below a certain value, but the record still exists in your history and may appear when you search or scroll.

Why It Works

Wallets typically show only the first few and last few characters of an address, with the middle truncated. A scammer's vanity address can match the visible prefix and suffix exactly, making the two entries look identical in the history view.

Most users do not expand each address to check the full string. If you have sent to the real address many times, the fake one blends in.

Dust transactions vs. address poisoning

The terms are related but not identical:

• Dust transaction - Any very small amount of cryptocurrency sent to a wallet, often for tracking or spam purposes. Not all dust is malicious; some airdrops use dust distributions.
• Address poisoning - A specific attack that uses a dust transaction to plant a lookalike address in your history. The dust is the delivery method, not the attack itself.

A dust transaction becomes address poisoning when the sender deliberately mimics an address you have used before.

How to Check Whether an Address in Your History Is Real

Do not trust addresses from your transaction history unless you can verify every character.

1. Always request a fresh address from the recipient - Ask them to send it through a channel you trust (their official website, a message in an app you have used before, or in person). Do not reuse an address from a previous transaction.
2. Compare the full address, not just the first and last characters - Expand the address in your wallet view or paste it into a text editor. Check every character against the real address.
3. Use a hardware wallet or wallet that shows a checksum - Many wallets display addresses with mixed-case letters that encode a checksum. If the case pattern looks wrong, the address is likely fake.
4. Search the address on a block explorer - If you have sent to the real address before, the block explorer will show the transaction history. A new address with no history or only a single tiny incoming transaction is suspicious.
5. Ignore unsolicited tokens or NFTs in your wallet - Scammers also send fake NFTs with embedded links or addresses in the metadata. Do not interact with them.

What to Do If You Receive a Suspicious Dust Transaction

• Do not interact with it - Do not click, approve, transfer, or try to return the dust. Interacting can trigger a phishing contract or confirm your wallet is active.
• Do not copy the sender's address - That is exactly what the scammer wants you to do.
• Hide or ignore the transaction - Most wallets let you hide specific transactions or tokens. Use that feature to remove the clutter from your history.
• No action required - The dust itself is harmless. It sits in your wallet as a negligible amount of value. The risk is only if you mistakenly use the associated address.

Why this attack persists

Address poisoning costs the attacker almost nothing. Generating a vanity address takes computing time but no significant fee beyond the dust transaction cost. A single successful copy-paste mistake can net the scammer the full amount you intended to send.

The attack also exploits a fundamental limitation of blockchain transactions: once sent, funds cannot be recovered. There is no "undo" button, no reversal, and no central authority to appeal to.

Summary

Address poisoning is a low-effort, high-reward scam that preys on habits formed by convenience. The only reliable defense is to verify every address character by character before sending, and to treat your transaction history as potentially contaminated. If you need to send funds to someone you have paid before, get their address again rather than trusting the one in your history.

Back to phishing