Address poisoning explained for investigators

A plain guide to how lookalike deposit addresses trick copy-paste habits, and what forensic reviewers should check before trusting transaction history.

Address poisoning is a scam built entirely around habit. An attacker generates a vanity address that shares the same first and last few characters as an address you regularly send to, then sends you a zero-value or 1-wei transaction from it. That transaction has no financial effect on its own. Its only job is to land in your wallet's transaction history so the lookalike address sits right next to the real one.

How the attack actually works

• The attacker studies which addresses appear in your outgoing history.
• They generate a new address matching the opening and closing characters of one you use often.
• They send a negligible or zero-value transaction to your wallet from that address.
• The lookalike now appears in your recent activity or address book, waiting to be copied by mistake.

The danger is entirely in the copy-paste step. Most people, and most analysts working fast, check the first and last few characters of an address and assume that's enough. Address poisoning exploits exactly that shortcut. If you copy the wrong entry from history without reading the full string, funds go straight to the attacker's address instead of the one you meant.

Why this matters for compliance and investigative work

For anyone reviewing wallet activity professionally, address poisoning also pollutes the evidence. A transaction history full of zero-value transfers from near-identical addresses can make manual review slower and more error-prone, and it can create false positives if an analyst assumes every address in a history list represents a genuine counterparty relationship.

What to actually do about it

• Always verify the full address string character by character before sending, not just the first and last few.
• Treat zero-value or dust transactions in a history list as noise until proven otherwise, not as confirmed counterparties.
• Save frequently used addresses to a trusted address book rather than copying from transaction history each time.
• When reviewing a wallet's activity for investigative purposes, flag and separate zero-value inbound transactions before drawing conclusions about relationships between addresses.

The rule is simple and worth repeating: verify the full address, not just the bookends.

WalletDNA's glossary keeps definitions like this one current, and its address labeling tools help surface which entries in a wallet's history are genuine counterparties versus dust from lookalike addresses.