Bitcoin address poisoning attacks are one of the more deceptive threats facing crypto holders today. Unlike phishing emails or fake exchanges, this attack is quiet. It doesn't ask you to hand over a password or click a suspicious link. Instead, it exploits something almost every Bitcoin user does without thinking: copying a wallet address from their transaction history. Understanding how it works is the first step toward making sure it never costs you.
What is a Bitcoin address poisoning attack?
An address poisoning attack works by sending a tiny, near-worthless Bitcoin transaction to your wallet from an address that looks almost identical to one you've used before. The attacker crafts a wallet address that matches the first several characters and the last several characters of a legitimate address you've recently interacted with. The middle characters are different, but most people never look that far.
The goal is simple: when you next go to send Bitcoin, you open your transaction history, scroll to a familiar-looking address, and copy it. You've just copied the attacker's address instead of the real one. You send your funds, and they're gone. Because Bitcoin transactions are irreversible, there is no recourse once the funds leave your wallet.
Why this attack is so effective
Bitcoin addresses are long strings of 26 to 35 alphanumeric characters. Most users verify only the first four or five characters and the last four or five, trusting that the rest match. Attackers know this. Modern vanity address generation tools can produce addresses with matching prefixes and suffixes in a matter of minutes, making the fake address nearly indistinguishable at a glance.
The attack is amplified by a common habit: using wallet transaction history as an address book. Many people don't store addresses separately. They scroll back through recent sends and copies, assuming those entries are trustworthy. A poisoning transaction quietly inserts a fake entry into that list, waiting for the moment you're in a hurry or distracted.
The small amount sent (often just a fraction of a cent in dust) costs the attacker almost nothing, but the potential return is enormous if you're sending a large transfer. Understanding what a private key in Bitcoin actually does also helps you appreciate why on-chain deception like this can be just as dangerous as having your keys compromised directly.
How to protect yourself
The most reliable defence is a simple habit change: never copy a wallet address from your transaction history. Instead, always get the destination address directly from the recipient, either through a verified message, a QR code scan, or your own saved contact list outside the wallet app.
When you do paste an address, verify the full string. Character by character if the transfer is large. Some wallets allow you to save named contacts so you're not relying on transaction history at all. Use that feature whenever it's available.
Hardware wallets and wallets with address verification on a separate device screen add another layer of protection. When the device forces you to confirm the address visually on its own screen, any manipulation in your clipboard or browser is immediately visible.
You should also configure your wallet to flag or hide dust transactions if that option exists. Some wallets allow you to mark incoming transactions as suspicious or block certain dust amounts from appearing in your history. These settings reduce the visual noise an attacker is trying to exploit.
For a broader view of the habits that matter most, the Bitcoin security checklist on this site covers the layered approach that keeps your holdings protected across multiple attack surfaces.
Recognising a poisoning attempt in your wallet
Most poisoning transactions share a few tell-tale signs. The incoming amount is tiny, often listed as dust or a fraction of a cent. The sender address looks familiar but doesn't correspond to any exchange or contact you recognise. The transaction has no accompanying message or memo, and it arrived out of nowhere with no obvious explanation.
If you see a transaction like this, treat it as a red flag. Don't interact with it further, and don't copy the sender address for any reason. Some security-conscious users choose to label the transaction in their wallet notes so they remember its purpose, which is to confuse, not to pay.
What to do if you've already sent to the wrong address
If you realise you've sent Bitcoin to a poisoned address, act quickly on the things you can control. Contact the exchange or service you used to initiate the transaction and report the event. While the transaction itself cannot be reversed, reporting it creates a record that may assist investigators or flag the attacker's address in shared scam databases.
Reaching out to a registered exchange provider is also worth doing. Reputable exchanges track flagged addresses and may be able to provide information or guidance, even if recovery isn't possible. This is also a good moment to audit your entire wallet setup: review saved addresses, enable two-factor authentication if you haven't already, and consider whether your storage method still suits the size of your holdings. Our guide on how to protect crypto assets walks through those steps in practical detail.
The broader lesson
Address poisoning attacks succeed because they exploit trust and habit rather than technical vulnerability. Your Bitcoin network itself is not compromised. No one has accessed your wallet. The attacker simply bet that you would be careless with a string of characters, and in many cases, that bet pays off.
The fix is awareness and deliberate process. Treat every destination address as something to be verified freshly, not assumed. Save trusted addresses outside your transaction history. Double-check the full address on every significant transfer. These habits cost you seconds but can save you everything.