Sent crypto to a lookalike address? Address poisoning explained

MetaMask describes the pattern: the scammer uses a “vanity” address generator to create an address that closely matches one you use, sends you a transaction of negligible value (usually a transfer of zero tokens), and waits for you to copy their address from your transaction history.

It works because most people check only the first and last few characters of an address. Etherscan notes that the fake address shares the same first and last few characters as the real one, and that these campaigns are automated, often inserting poison transfers within minutes of a legitimate transaction.

Very. Researchers at Carnegie Mellon, presenting at USENIX Security 2025, measured 270 million on-chain poisoning attacks targeting 17 million victims on Ethereum and BNB Smart Chain, with at least 6,633 successful incidents causing $83.8 million or more in losses.

Single losses can be enormous. Chainalysis documented a victim who sent about $68 million in wrapped bitcoin to a poisoned address in May 2024; the funds came back days later, which is unusual.

No. MetaMask notes that transactions are immutable once confirmed, and Etherscan puts it plainly: there are no undo buttons in crypto. Anyone who tells you they can reverse it, for a fee, is running a recovery scam.

• —If you sent USDC: Circle's terms say it may freeze USDC when it receives a legal order from a valid government authority.
• —If you sent USDT: Tether freezes USDT following appropriate legal proceedings, working with law enforcement.
• —If the funds move to an exchange: the exchange can act on a police report or court order.
• —In every case, report it quickly with the transaction hash, your address, the poisoned address, the amount and the time, to the police and to the IC3 (or Report Fraud in the UK). Speed matters, because funds that are swapped or moved on become harder to stop.

• —Save addresses you use regularly in your wallet's address book, and send from there.
• —Never copy an address from your transaction history.
• —Check the middle characters of an address, not just the start and the end.
• —Send a small test transaction to a new address, but copy the address from the same trusted place for the full payment. In the Chainalysis case, the victim sent a test to the real address and then copied the poisoned one.
• —Take your wallet's lookalike-address warnings seriously. MetaMask and Trust Wallet both warn when a destination resembles an address in your history.

We trace where the funds went after the poisoned address received them, and whether they reached an exchange or are still held as a freezable stablecoin, and we document it in a report law enforcement or your lawyer can act on. The intake review is free.