← Guides

What is address poisoning (and how to spot it)

Address poisoning doesn't hack your wallet. It waits for you to copy the wrong address from your own history.

How it works

An Ethereum or Base address is 40 hexadecimal characters, so most people recognise one by its start and end and copy it from their recent transactions. Address poisoning exploits exactly that habit. The researchers who measured it describe the attack in three steps: the attacker generates a lookalike of an address you have dealt with, “poisons” your transaction history with it, and waits for you to send tokens to the lookalike instead of the real recipient.

  1. You make a real payment. Bots watch the chain and see who you pay.
  2. A lookalike is generated. It shares the first and last few characters with your real counterparty. On Base we see bots match the first 4 and last 4 hex characters after 0x; finding such an address takes ordinary GPU software little time.
  3. Bait lands in your history. A transfer between you and the lookalike appears, often within minutes of your real payment. It is usually one of three kinds: a transfer of exactly 0 of a real stablecoin, a transfer of a worthless token named like USDC or USDT (see fake token transfers), or a tiny real amount sent from the lookalike.
  4. You copy the wrong line. The next time you pay that counterparty and copy the address from your history, the money goes to the attacker. A blockchain payment can't be reversed by the sender.

How big is it?

A two-year study of Ethereum and BNB Smart Chain found 270 million poisoning attempts aimed at 17 million victims, and 6,633 incidents that caused at least 83.8 million US dollars in losses. On Base, our own watcher has flagged more than 1.9 million lookalike addresses since September 23, 2026 (live count).

How to spot it

  1. A transfer you don't remember. A 0 transfer, or an incoming or outgoing amount you didn't make, right after a real payment, is the classic sign.
  2. Two lines that look the same. If your history shows two counterparties with the same first and last characters, at least one of them is bait.
  3. Read the middle. Compare the full address, especially the middle characters, not just the start and end.
  4. Unknown tokens with famous names. A “USDC” or “USDT” from a contract that isn't the issuer's official one is fake.
  5. Check the address. Paste it into our free checker to see whether it has been used as a poisoning lookalike on Base.

How to stay safe

Check a Base address for free → see if it was used as a poisoning lookalike. For businesses → screen payouts, withdrawals and wallet sends against our feed of flagged lookalikes.

Sources