Address Poisoning Scam: The Copy-From-History Trap Explained

Lesson 4 of 10 · Beginner

What is address poisoning?

Address poisoning is one of the simplest and yet costliest Tether scams. In this method, nobody hacks your wallet. You yourself, with your own hands, send the money to the scammer's address, because you mistook it for a familiar address of yours.

The scale of the problem is not small. According to Bitquery data published by CoinLaw, about 4.5 million wallets were targeted by this attack between late October 2025 and early October 2026, and single-victim losses ranged from about 30,000 dollars up to about 50 million dollars of Tether. Because people often send money regularly to one fixed address (for example an exchange deposit address), this trap is entirely real.

How the attack works, step by step

1. Reconnaissance: the attacker's bots watch Tether transactions on-chain and find wallets that regularly send significant amounts to fixed addresses.
2. Building a look-alike address: using software, the attacker generates an address whose first few and last few characters exactly match your usual destination. The middle differs, but most wallets abbreviate the middle of an address with three dots.
3. Planting it in your history: the attacker makes the fake address show up in your transaction history. There are three common ways: a zero-value Tether transfer that appears to come from you, a dust deposit of real Tether, or a deposit of a fake token with the name and symbol USDT from a counterfeit contract.
4. Waiting: the next time you want to pay the same destination, you go to your history, copy the first address that looks right and send. The money reaches the attacker, and the transaction is irreversible.

The subtle point is that a zero transfer can really show up in your history as a “send” without you having signed anything, because on some networks the token contract allows a zero-value transfer on behalf of anyone. So “I sent this myself” is not proof that the address is right.

Why even experienced people fall for it

This attack exploits habit, not ignorance. Three factors help it succeed:

• Address abbreviation: wallets and explorers usually show the first and last few characters of an address. The attacker has copied exactly those parts.
• Hurry and repetition: someone who sends money to the same address every week eventually stops looking carefully.
• A misleading test transaction: if you copy the wrong address for the test transaction too, the test “succeeds”, because the money reached the attacker's address and he does not object. A test transaction is only useful when the recipient confirms receiving it.

Hypothetical example: suppose your usual deposit address begins with TQx9 and ends with 7mKd. One day you see two addresses in your history that both begin and end with those characters. You created one, and the attacker the other. If you look only at the beginning and end, you have no way to tell.

The right method: an address book and a full check

• Never copy an address from transaction history. This is the most important rule of this lesson.
• Build an address book. Take frequently used addresses once from the original source (for example the exchange deposit page or the recipient), check them in full and save them under a clear name. From then on, choose only from the address book.
• Turn on the withdrawal allowlist at your exchange, so withdrawals are possible only to pre-approved addresses.
• Check the whole address, not just the beginning and end. Compare it piece by piece against the original source.
• Hide zero-value and spam transactions. Many wallets have an option to hide unknown tokens and trivial transfers.
• An exchange deposit address can change. Before every large deposit, fetch the address again from the deposit page.
• If you see a zero or dust deposit from an address resembling familiar ones, treat it as a warning: your wallet has been targeted. Do nothing with that transaction.

What if I sent to the wrong address?

Realistically, in most cases money sent to a poisoned address does not come back. Still, a few things are worth doing, and quickly:

• Record the transaction hash and note the attacker's address and the exact time from its explorer page.
• Follow the money. If it moved from the attacker's address to a centralised exchange, tell that exchange's official support with full details.
• File an official report. A complaint to your country's cybercrime police or the cybercrime unit where you live is the legal route. The Tether issuer usually freezes addresses on the request of legal authorities.
• Beware of “recovery” people. Those who message you after this and promise to get your money back for a fee are almost always a second scammer.

📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map

Frequently asked questions

Can an address poisoning loss of Tether be reversed?

A blockchain transaction cannot be reversed. There is only a limited chance if the money reaches a cooperating centralised service or the issuer freezes it. Prevention is the only reliable way.

Why do I see a zero-value send in my history that I did not make?

With some token contracts, anyone can record a zero-value transfer in your name. It is usually a sign you have been targeted for address poisoning, and the only response needed is caution.

Is a wallet address book enough?

If you saved the address once from the original source after a full check, yes, it helps a great deal. But you must also take into account that an exchange deposit address may change.

Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.