Address poisoning scam tainting your crypto transaction history
You copy an address from your history. You paste it. You think you are sending to the right person. In that fraction of a second, the scam works.
Address poisoning is a low-tech, high-efficiency fraud. It exploits a habit: reusing past transaction addresses instead of verifying the recipient fresh each time. Scammers rely on haste, not hacking.
How the Poisoning Works Step by Step
The attacker monitors a blockchain for your transaction activity. Once they see you send funds to a legitimate address, they generate a new wallet whose address visually resembles that target. This is trivial with vanity-address generators.
Next comes the poison. The scammer sends a small amount of crypto - often called "dust" - or a zero-value token transfer to your wallet from that lookalike address. The transfer is irrelevant in value. Its only job is to appear in your transaction history.
When you next check your history to find the recipient you previously paid, the lookalike address sits nearby. It might share the first four and last four characters. Many users only check the beginning and end of a long string. They copy the scammer's address, paste it, and send real funds directly to the thief.
The transaction history is not corrupted. Your balance is not touched. You just trust the wrong line.
Address poisoning vs. dusting attacks
These two tactics are frequently confused. Both involve tiny amounts of crypto landing in your wallet. The intent is completely different.
Dusting attacks are reconnaissance. Scammers send minimal amounts to thousands of wallets, then track those addresses across transactions to deanonymize the owner. The goal is to link identities or targets for phishing.
Address poisoning is point-targeted fraud. The scammer knows exactly who you transacted with. They do not care about your privacy. They want you to misdirect a single, usually large, payment. One mis-copy can cost you a house deposit.
You can receive a tiny amount from a stranger and not be poisoned. Poisoning is defined by whose dust arrives and whether it mimics a known contact.
The Nonce-Too-Low Diagnostic
There is a technical red flag some victims encounter - but not always. If you attempt to send a transaction after the poisoner's dust has landed, and your wallet returns a "nonce too low" error, that is a strong signal.
On Ethereum-compatible chains, every transaction from an address carries a sequential nonce starting at 0. The poisoner, having sent dust from your address? No - that error actually occurs when the scammer attempts to spend from their lookalike address but misconfigures the nonce. For a victim, seeing "nonce too low" when confirming a transaction suggests the outgoing address in your history has had its state tampered with. More commonly, the error indicates you are trying to rebroadcast an old or pending transaction.
Do not ignore that error. Pause. Verify the recipient address independently.
Tools to verify before you send
Etherscan and BscScan offer a simple layer of defense. After you copy any address, paste it into the search bar of the relevant block explorer. Check the transaction history of that address. Does it show a pattern of sending small, useless transfers? Does its creation date match the date you first transacted with the real recipient? Scammer addresses are often brand-new.
Etherscan also provides a "Address Label" feature when you are logged in. You can label your trusted contacts. If a label you applied does not appear, you have the wrong address.
Rabby wallet goes further. It automatically warns you if you are about to send to an address that has never appeared in your history before - or if the recipient address is a known scam. Rabby also highlights the full address string and compares it to your address book. A mismatch triggers a clear popup.
These tools are not optional. They are a 15-second check that can save everything.
The Bottom Line
Address poisoning works because humans skip steps. The technique is older than crypto, just re-skinned for blockchains. The fix is not technical. It is procedural: verify the full address before every transaction, especially if you copied it from history. Use a block explorer, use a smart wallet, use a label. Do not let a few identical characters cost you your funds.
Not financial advice. watifsol.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.