What is address poisoning?
Address poisoning is a crypto scam where an attacker plants a look-alike wallet address in your transaction history, usually with a zero-value or tiny transfer. If you later copy that address instead of the real one and send USDT, the money goes to the attacker. Your keys are never stolen, and the transfer can't be reversed.
Most crypto theft needs a hacked exchange, a leaked seed phrase or a bad signature. An address poisoning scam needs none of that. It needs you to copy the wrong line. On 20 December 2025, one trader sent 49,999,950 USDT to a scammer this way, minutes after a careful 50 USDT test transfer to the right address.
This guide covers how an address poisoning attack works, why USDT is the main target, how to spot a fake wallet address, and the habits that stop it. If stablecoins are new to you, read our guide on what a stablecoin is first.
How does an address poisoning attack work?
Bots do almost all the work, which is why the scam runs at such scale. A typical attack has five stages.
- Watch. Bots scan networks such as Ethereum, BNB Chain and Tron for wallets that move USDT often, and they note who those wallets pay.
- Generate a look-alike. The attacker creates a vanity address with the same first and last few characters as your usual recipient. A modern GPU finds a match on four characters at each end in minutes.
- Plant it. A transaction involving the look-alike lands in your history. The three common methods are below.
- Wait. The fake entry sits next to the real one until you need to pay. In a February 2026 case flagged by Cyvers, 32 minutes passed between the poisoning and the loss.
- Cash out. Once the money arrives, the attacker swaps and splits it fast. In the December 2025 case, the USDT was turned into DAI and then ETH, and much of it went through Tornado Cash within about half an hour.
The zero-value transfer scam
This method surprises people most, because it can make it look as if you paid the attacker. USDT and most EVM tokens follow the ERC-20 standard, which includes a transferFrom function. It lets an approved party move tokens for you. In many token contracts, a transfer of zero tokens passes the approval check, because zero is never more than your zero allowance. So anyone can create a "transfer" of 0 USDT from your address to theirs.
No money moves, so you get no alert. But your wallet or explorer may list it as an outgoing payment from you, which makes the fake address look like someone you've paid before. Some explorers hide zero-value transfers by default. Many wallet apps still don't.
Fake tokens and dust
The other two methods end in the same place, with a fake wallet address sitting right next to a real one.
| Method | What you see | What actually happened |
|---|---|---|
| Zero-value transfer | An outgoing 0 USDT payment to an address that looks familiar | The attacker triggered it from their side. No money moved |
| Fake token transfer | A "USDT" payment, often for the same amount you just sent | A worthless token named USDT, from a contract the attacker deployed |
| Dust transfer | A tiny real deposit, such as 0.01 USDT, from a familiar-looking address | The attacker paid a few cents to get into your history |
Why is USDT the main target?
Attackers follow the money, and a lot of it sits in USDT. Four things make it attractive.
- Big single transfers. A treasury move or an OTC settlement can send millions in one transaction. One mistake pays for millions of failed attempts.
- Repeat recipients. Exchange deposits, supplier invoices and payouts go to the same addresses again and again. That gives bots a pattern to copy.
- Cheap attempts. After Ethereum's fee cuts in December 2025, a poisoning transaction costs cents. On cheaper chains it costs even less.
- No undo. A confirmed transfer is final. There's no chargeback and no bank to call.
Real address poisoning cases
In every case below, the victim copied a fake address. Nobody stole a key. Figures are as reported by security firms and news outlets.
| Date | Loss | What happened |
|---|---|---|
| May 2024 | About $68 million in wrapped bitcoin | The victim copied a poisoned address. The attacker later returned most of the funds after public pressure. |
| December 2025 | 49,999,950 USDT | A 50 USDT test went to the right address. Minutes later, the full amount went to a poisoned one. |
| January 2026 | 4,556 ETH, about $12.25 million | Funds meant for an OTC deposit address. ScamSniffer said the two addresses matched in every visible character. |
| February 2026 | About $600,000 in USDT | Flagged by Cyvers. The attack took 32 minutes from poisoning to loss. |
The wider numbers are just as stark. Carnegie Mellon researchers counted about 270 million poisoning attempts on Ethereum and BNB Smart Chain between July 2022 and June 2024, aimed at 17 million victims. They confirmed 6,633 successful attacks worth at least $83.8 million. Blockaid flagged 65.4 million poisoning transactions between January 2025 and February 2026, and Cyvers puts Ethereum attempts at over a million a day.
These sources count different things, so don't add the figures together. The pattern is what matters. Nearly every attempt fails, and the few that work pay for all the rest.
How to spot a fake wallet address
An EVM address has 42 characters. Almost nobody reads them all. We check the start and the end, and many wallets hide the middle behind dots. Attackers copy exactly the parts you look at. Here's what that looks like.
- Real.
0x7A3F51c09E2bD84f6A1e73C0d5b9F28a1e4BC92E - Fake.
0x7A3Fe8b2470A6c1F93dE05b8A27c41f6D90eC92E
Shortened, both show as 0x7A3F…C92E. The middle 32 characters are completely different. These are the warning signs to watch for.
- A transfer you didn't make. A 0 USDT payment, or a tiny one, to or from an address you don't recognise.
- Two near-identical addresses in your history. This is the clearest red flag. Stop and compare them in full.
- A new entry right after a real payment. Bots react within minutes of your transfer, sometimes faster.
- A "USDT" token you never held. Fake tokens borrow real names. Check the token contract address, not the label.
- A wallet warning about a new or similar address. Read it. Don't click past it because you're in a hurry.
How to stay safe from address poisoning: 8 habits
- Never copy an address from your transaction history. Get it from the source, meaning the recipient's invoice, their exchange deposit page or a QR code they sent. History is the one place an attacker can write to. If you change one habit, change this one.
- Save trusted addresses in an address book. Verify the full address once, give it a clear label, and pick it from your contacts every time after that.
- Turn on withdrawal allowlists. Most big exchanges let you lock withdrawals to approved addresses, often with a waiting period before a new one works.
- Compare the whole address. Read it in chunks of four to six characters, start, middle and end, on the screen where you confirm the send.
- Don't let a test transfer relax you. The December 2025 victim sent a perfect test, then got poisoned before the main transfer. Re-check the address after every test.
- Hide zero-value and spam transfers. Switch on the filters in your wallet and explorer. They won't catch every variant, but they clear out most of the noise attackers rely on.
- Use a wallet that checks for look-alikes. Since June 2026, MetaMask compares every pasted address with addresses you've used before. If the ends match but the middle doesn't, it blocks the send with a warning. It works on mobile and the browser extension across EVM networks.
- Slow down on big amounts. Confirm the address on a call or a second channel, or have a colleague check it. Address poisoning works when you're in a hurry.
How to check a wallet address before you send USDT
Use this check whenever the amount matters. It takes about two minutes.
- Get the address from the source. Copy it from the recipient's invoice, deposit page or QR code, or pick it from your saved address book. Never take it from your transaction history.
- Check the network. Make sure the recipient expects the network you're sending on, such as ERC-20, BEP-20, TRC-20 or TAAQO.
- Compare the full address. Read the start, middle and end in groups of four to six characters and match each group against the source.
- Send a small test. Send a small amount first and ask the recipient to confirm it arrived.
- Look for new entries. Check your history for any new zero-value, tiny or look-alike transfers that showed up after the test.
- Re-verify and send the rest. Copy the address again from the source, compare it in full once more, then send the main amount.
- Confirm on the explorer. Open the transaction on a block explorer and check that the receiving address matches the source.
Picking the wrong network is a separate way to lose USDT. Our guide on moving USDT from Binance to your own wallet walks through network choice step by step.
Does address poisoning happen on TAAQO?
It can. TAAQO is EVM-compatible, so its addresses look the same as Ethereum or BNB Chain addresses, 0x followed by 40 characters. Any network where anyone can send or create a token can carry poisoned entries. No chain removes the need to check.
The good part is that practice costs nothing. Add the TAAQO network to your wallet from the network settings page, get free test tokens from the faucet, and run the seven-step check above until it feels automatic. Then open each test transfer on TAAQO Scan and confirm the receiving address character by character.
If you move USDT between chains, open the bridge only from the link on taaqo.com. Never use a link from a search ad, a DM or a group chat.
Address poisoning prevention for businesses
Companies pay the same suppliers again and again, and finance teams work fast. That's exactly the profile bots look for. A few rules close most of the gap.
- Keep an approved payee list. Pay only from stored, verified addresses. Never pay from chain history or a forwarded message.
- Use two approvers for new or changed addresses. Confirm any change by calling the payee on a number you already had.
- Lock down automation. Scope API keys tightly and require 2FA, so a leaked key can't redirect payouts.
- Show the full address on every invoice. Add a QR code too. Customers then never need to copy from an old transaction.
What to do if you sent USDT to a poisoned address
Recovery is unlikely. Blockchain transfers are final, and attackers move funds within minutes. Acting fast still gives you a small chance, and it protects you from the scams that follow.
- Save the evidence. Write down the transaction hash, both addresses, the amount and the time. Don't send anything else from that wallet in a panic.
- Contact your exchange. If the funds came from or went to an exchange, tell its support team right away. Compliance teams can sometimes flag the receiving address.
- Report it to the police. In the UAE, use Dubai Police's eCrime platform at ecrimehub.gov.ae, Abu Dhabi Police's Aman service, or the Ministry of Interior's cybercrime platform at moi.gov.ae. Outside the UAE, use your national cybercrime service. Tether can freeze USDT at specific addresses and has done so for law enforcement, but that needs a formal report and quick action.
- Ignore recovery services. Victims get targeted by fake "recovery experts" who charge upfront fees. MetaMask's June 2026 security report warned about this. Nobody can promise to get your funds back.
Frequently asked questions
What is address poisoning?
Address poisoning is a crypto scam where an attacker plants a look-alike wallet address in your transaction history, usually with a zero-value or tiny transfer. If you later copy that address instead of the real one and send USDT, the money goes to the attacker. Your keys are never stolen, and the transfer can't be reversed.
How does an address poisoning scam steal USDT?
Bots watch for wallets that move USDT, create an address with the same first and last characters as a usual recipient, and plant it in the victim's history. When the victim copies the fake address and sends USDT, the attacker receives it. No private key or seed phrase is needed.
What is a zero-value transfer scam?
It's a type of address poisoning that uses the transferFrom function in token contracts. A transfer of zero tokens passes the approval check in many contracts, so an attacker can make it look as if you sent 0 USDT to their look-alike address. No money moves, but the fake entry appears in your history.
Is my wallet hacked if I see a poisoned transaction?
No. A poisoned entry doesn't mean anyone has your keys. The attacker only wrote a record to the public blockchain. Your funds are safe as long as you don't send to the look-alike address. Ignore it and only use addresses you've verified.
How can I tell if a wallet address is fake?
Compare the full address, not just the first and last characters. Watch for two near-identical addresses in your history, zero-value or tiny transfers from strangers, and tokens called USDT that you never held. A wallet with look-alike detection will also warn you.
Can I get USDT back after an address poisoning attack?
Usually not. Blockchain transfers are final and attackers move funds within minutes. Report it to your exchange and to the police straight away. Tether can freeze USDT at specific addresses in some cases, but there's no guarantee. Never pay a recovery service.
Does address poisoning happen on every blockchain?
It mostly hits account-based networks where anyone can send a token to any address, such as Ethereum, BNB Chain, Tron and other EVM chains, TAAQO included. The defence is the same on all of them. Never copy an address from your history.
Where do I report address poisoning in the UAE?
Use Dubai Police's eCrime platform at ecrimehub.gov.ae, Abu Dhabi Police's Aman service, or the Ministry of Interior's cybercrime platform at moi.gov.ae. Include the transaction hash, both addresses, the amount and the time.
Final thoughts
Address poisoning doesn't break any code. It breaks a habit. Copying from history is quick and almost always fine, and that's why it's so dangerous on the one day it isn't. Get addresses from the source, save the ones you've checked, read the middle, and slow down when the amount is large.
Want to practise without risk? Grab free test tokens from the TAAQO faucet and run the pre-send check a few times. New to crypto? Start with our guide on how to buy crypto safely. This article is for information only and isn't financial or legal advice. Figures are as reported by the named security firms and researchers and may change.