Address Poisoning: How Look-Alike Addresses Steal USDT

Address poisoning is a trick, not a hack. A scammer makes an address that starts and ends like one you use, sends a tiny or zero-value transfer from it, and waits for you to copy the fake address from your history. The defence is simple: never copy a recipient from your transaction list, and check the whole address every time.

How the attack works

Etherscan describes the pattern. Automated systems generate look-alike addresses that copy the first and last characters of real ones. The attacker then sends tiny or zero-value transfers so the fake address shows up in your history, hoping you copy it next time.^[1]

A Carnegie Mellon study of Ethereum and BNB Smart Chain found three kinds of "poison": tiny transfers, zero-value transfers, and transfers of counterfeit tokens from look-alike addresses.^[2] The aim is always the same. Your history fills up with entries that look familiar, and one of them is wrong.

If your wallet shortens addresses on screen to the first and last few characters, the part you see is exactly the part the attacker copied.

How big the problem is

The figures come from researchers and companies that study it. They count what they can detect, so treat them as minimums.

The Carnegie Mellon authors call their loss figures a conservative lower bound. They found far more attacks on BNB Smart Chain than on Ethereum and link this to lower fees. Some attacker groups reused the same look-alike addresses on both chains, since one 0x address works on every EVM chain.^[2]

One mistake, $68 million

Single losses can be very large. Chainalysis reports that in May 2024 one Ethereum user sent about $68 million in wrapped bitcoin (WBTC) to a look-alike address. The funds were later returned.^[4] Do not count on that: a blockchain transfer has no built-in way back.

TRON: dust that arrives in seconds

USDT on TRON is a common target. TRM Labs reports that scammers there send tiny amounts of TRX, often worth less than $0.01, from addresses made to look like ones you have used. TRM says TRON's free bandwidth for basic TRX transfers makes this cheap to do at scale.^[5]

In one case TRM traced, the dust arrived about 18 seconds after a real USDT payment. The sending address matched the first and last two characters of the real recipient.^[5] So the fake entry sat right next to the genuine one in the victim's history.

TRM also warns against links placed in TRON memo fields.^[5] A memo is just text that anyone can attach. Do not open links from it.

What does not protect you

• Checking only the start and end. That is exactly what the attacker matched. In the TRM case, two characters at each end were enough.^[5]
• Copying from your own history. Your history is the thing being poisoned.
• An AML check alone. An AML score describes an address's past links to risky sources. It does not tell you whether this is the address you meant to pay. A fresh look-alike address may have no history at all.
• "Recovery" offers. The FBI warns that fake recovery firms charge an upfront fee and then disappear, and that law enforcement does not charge victims a fee.^[6] See our page on fake AML checkers for the related tricks.

Tools that help

Etherscan's Address Highlight feature marks matching addresses in a transaction list. It helps you see when two similar-looking addresses are in fact different.^[1] Many wallets also offer an address book. Saving a verified address once, and sending only from the book, removes the need to copy from history.

What to do: a checklist before every USDT send

1. Get the address from the source. Copy it from the exchange's deposit page or from the person you are paying, in a channel you trust. Not from your transaction list.
2. Compare the whole address. Read it in chunks, middle included, against the source. Matching start and end proves nothing.
3. Save it in your address book once you have confirmed it. Send from the book next time.
4. Send a small test first for a new or large payment, and ask the recipient to confirm it arrived.
5. Ignore unexpected tiny deposits. TRM advises treating unsolicited micro-deposits as suspicious.^[5] Do not interact with them or with zero-value "transfers" from look-alike addresses.
6. Never open links from memos or from tokens you did not ask for.
7. Check the network. Make sure the address and network match what the recipient gave you.

If you receive USDT from someone new, it is still worth checking where it came from. See how to check USDT before receiving and our TRON network page.