Crypto Payment Address Poisoning: Explained with Examples

Definition

Crypto Payment Address Poisoning is a scam in which an attacker places a look-alike address into a user’s transaction history or workflow to induce a future payment to the attacker. It exploits visual comparison and address copying rather than breaking the cryptography of the legitimate wallet. In practice, the attacker creates a visually similar address and causes it to appear in transaction history or another trusted-looking context, after which the victim copies it for a later transfer.

Overview

Mechanism and important distinctions

This attack is often possible because blockchain transaction history is public and wallet interfaces prioritize recent entries. An attacker can generate addresses with matching beginning or ending characters and introduce them into a history through tiny transfers or token events. A victim later searches that history for a familiar payee and selects the impostor. The initial dust transfer is not the theft; the later legitimate-looking payout to the wrong address causes the loss.

The appropriate defense is a verified beneficiary directory with independent enrollment, not an instruction to ignore every small transfer. Businesses should require additional approvals when a recipient address changes and show meaningful fingerprints from a trusted record. A valid checksum and apparent address similarity do not establish association with a supplier. Maintain incident evidence including the genuine payee, impersonator address and transaction chronology.

Crypto Payment Link Hijacking; Crypto Payment Address Screening; Crypto Payment Clipboard Hijacking

Example

After viewing an account's public history, an attacker sends a tiny token or low-value transaction from an address that resembles a frequent payee. The false entry appears near genuine transfers in wallet history. Later, a user copies the attacker address from that history and makes a large payment to the wrong recipient.

Comparison

This is a social-engineering attack against address selection, not a method of reversing a blockchain transaction. Keep verified beneficiary records outside raw transaction history, display full addresses when approving sensitive payments and require confirmation of newly added destinations. Similar first and last characters are not proof of address ownership.

Key Takeaway

Use verified payee records instead of selecting recipients from recent wallet activity.

Sources

Address Poisoning Scams — MetaMask Help Center (2026-08-02)
Clipboard Data, Technique T1115 — MITRE ATT&CK (2026-08-02)
Webhook — OxaPay (2026-08-02)