What Is Address Poisoning? The Zero-Value Transfer Scam Explained (2026)
No signature, no approval, no access to your wallet — address poisoning steals by arranging your next mistake. Scammers send you zero-value transfers from an address that looks like one you regularly use; your transaction history now contains a poisoned twin; weeks later you copy-paste the “familiar” address from history and send real funds to the attacker. Here’s the full mechanics and the habits that neutralize it completely.
What is address poisoning?
A social-engineering attack on your transaction history. The attacker creates an address sharing your regular counterparty’s first and last characters (vanity-generated — cheap on some chains, brute-forced on others), sends you a zero-value transfer (or a tiny dust transfer) from it, and waits. When you later pick an address by scrolling history — seeing “0xAb3…f9c2” and pattern-matching “that’s my exchange” — you send real funds to the twin. The attack is documented across chains with a rising wave through 2026; the full mechanics piece covers the generation methods.
Why can’t dust alone steal anything?
Important to be precise: receiving a zero-value transfer compromises nothing. The attacker doesn’t learn your key, gains no approval, and can’t move your funds. The transfer is advertising — it exists to place a poisoned row in your history. All the actual risk lives in your next manual send. That’s also why the defense is behavioral, not technical: no revocation needed, no emergency — just don’t pick addresses from history.
Which habits neutralize address poisoning?
- Use the address book. Save counterparties once (labeled), send from the book, never from history. This single habit defeats the attack.
- Verify more than 4 characters. Pattern-matching “0xAb3…f9c2” is the attack’s whole mechanism — compare the full string or at minimum 8+ characters from both ends. EIP-3770/checksummed formats help if your tooling supports them.
- Send a test transaction for new counterparties and first-sends-after-long-gaps — a $1 test poisons no one and confirms the pipe.
- QR codes over typing. Scanning a QR from a verified source bypasses the history-pick entirely.
- Ignore poisoning attempts — don’t interact, don’t send to the twin “to get it back,” don’t reply. The dust is spam; treat it as such. If a real transfer landed from a twin you don’t recognize, that’s a signal someone probed you — tighten verification for that counterparty.
How does address poisoning affect Polymarket users?
Deposit and withdrawal addresses are the high-value targets: a poisoned “deposit address” row in your history is a one-mistake path to losing a withdrawal. Bookmark your Polymarket deposit address from the official UI (see deposit mechanics), and run the deposit checklist if anything looks off before sending again. Post-7702, remember that poisoning plus delegation is worse: a sweeper on your address takes everything that arrives — check delegation state too (the free check).
FAQ
What is address poisoning in crypto? An attack where scammers send zero-value transfers from lookalike addresses to seed your transaction history with a poisoned twin — the theft happens later, when you copy the familiar-looking wrong address for a real send.
Can someone steal my crypto with just my address? Not directly — the address is public. Poisoning exploits your future copy-paste, not your wallet: no key, no approval, no access is gained from the dust transfer itself.
How do I check if I’ve been address-poisoned? Scan your transaction history for inbound zero-value transfers from addresses resembling your regular counterparties. If found: add real counterparties to your address book, verify full addresses on future sends, and simply don’t interact with the poisoned rows.
Does address poisoning affect Polymarket users? Yes — deposit/withdrawal addresses are prime targets. Save your deposit address from the official UI, verify full strings on withdrawals, and see the scam catalog for the full 2026 threat map.
I sent funds to a poisoned address — can I recover them? Only if the receiving wallet’s owner cooperates (they won’t) — on-chain transfers are final. Prevention is the entire defense: address book + full-string verification + test sends.
Educational content, not financial advice. Not affiliated with Polymarket. Last updated October 2026.