An attack that breaks nothing. No stolen keys, no malicious contract, no signature you did not mean to give. It targets a habit every wallet interface has trained into you, and in one case, it took $50 million in under an hour. Part of Know the Scam by SimpleSwap.

Crypto addresses are 42-character hexadecimal strings that are meaningless and hard to remember. That is why most interfaces truncate them: the first four characters, an ellipsis, and the last four. People read the ends; the middle is ignored.

Address poisoning is the discovery that this display convention is an attack surface.

Researchers at Carnegie Mellon documented 270 million poisoning attempts across Ethereum and BNB Chain between July 2022 and June 2024, aimed at 17 million unique wallets, with confirmed losses above $83 million. Their conclusion was blunt: this is quietly one of the largest phishing operations running on public blockchains.

How it works

Four steps, each individually harmless.

1. The attacker picks a target. Bots continuously monitor the chain for wallets with regular activity, especially those moving large stablecoin balances. Dormant wallets are not worth the gas.

2. They generate a lookalike. GPU-powered vanity address generators produce thousands of candidate addresses per second until one matches the target's first few and last few characters. In the December 2025 case, the fake matched the first three and last four hex characters, seven fixed positions in total. Truncated in any wallet interface, the two addresses are identical.

3. They plant it in your history. The attacker sends a tiny or zero-value transfer from the lookalike address to you. That dust does nothing except add the fake address to your transaction list, sitting among the addresses you actually use, looking exactly like one of them.

4. They wait. The next time you send funds and reach for your history rather than your address book, the trap either works or it does not. No further action is required from the attacker.

Nothing is hacked at any point. The resulting transaction is valid, signed by the rightful owner, and executed exactly as instructed. It simply goes to the wrong place, and no exchange or swap service can reverse it.

The case that should change how you send

On December 20, 2025, a trader lost 49,999,950 USDT, close to $50 million, to a poisoned address. The whole thing took under an hour, and the funds were converted to ETH, split across wallets, and partially routed through a mixer.

Read the sequence carefully, because it is the reason this article exists.

The victim did the thing everyone recommends. They first sent a 50 USDT test transaction to the correct address, and it arrived successfully. Watching the chain, the attacker then pushed a 0.005 USDT dust transfer from a lookalike address into the victim's history, landing it immediately after the successful test. Minutes later, the victim copied from that history for the real transfer, and 49,999,950 USDT went to the attacker.

The victim later offered a $1 million white-hat bounty for the return of the funds. It went unanswered.

So the standard advice is not wrong, but it is dangerously incomplete. A test transaction verifies the address. It does not protect the gap between the test and the real send, and that gap is precisely where the poison arrives.

In January 2026, the same pattern took 4,556 ETH, roughly $12.25 million, from another holder.

Why 2026 made this worse

The economics were always absurd. A May 2024 victim lost $68 million in wrapped Bitcoin to an attack that cost the scammer about $0.65 in gas.

But at scale, the dust transfers added up. Then Ethereum's Fusaka upgrade landed in December 2025, cutting fees by roughly six times. Good for users, it removed the last cost barrier to mass poisoning overnight.

The numbers changed fast. Poisoning attempts went from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x jump in two months. One attacker contract sent three million dust transfers to over a million addresses for a total cost of $5,175.

The prevention checklist

• Ordered by how much each one actually does.
• Never copy an address from transaction history. This is the whole attack. History is a log of what happened, not a list of addresses you trust. Treat it as read-only.
• Keep a real address book. Save addresses you use repeatedly in your wallet's contacts or whitelist, entered once from a source you control. Then select from there every time. This removes the decision entirely, which is better than remembering to be careful.
• Verify the middle, not just the ends. If you are checking manually, the first and last four characters are exactly what the attacker matched. Compare a run of characters from the center, or better, compare the full string.
• Re-enter the address for the real transfer, not just the test. The $50 million case turned on this. If you send a test, go back to your trusted source for the main transaction rather than reusing anything from history.
• Use ENS or a domain name where available. A human-readable name removes the character-matching problem at its root, though you should still confirm the name resolves to the address you expect.
• Ignore unexpected dust. Small, unrequested transfers are not free money or a glitch. They are usually bait, and the correct response is to leave them alone and never interact with the sender.
• Slow down on large transfers. The victims in these cases were not careless people. They were moving large sums using a workflow that is fine ninety-nine times and catastrophic once.

Where this meets your swap

This is the one attack on our map that lands squarely inside our own flow, and it would be dishonest to present it otherwise.

Every SimpleSwap exchange asks you for a receiving address. That is the moment address poisoning targets. We generate the deposit address you send to, but the address your converted funds arrive at is one you provide, and if it is poisoned, the transfer is valid, final and unrecoverable. No exchange can undo a correctly executed transaction to a wrong destination.

So the check belongs to you, and it is a short one: paste from your own wallet or address book rather than from any transaction list, then compare the middle of the string, not just the ends. If the swap is large, do it twice before confirming.

It is worth being just as attentive to the deposit address we show you. That address cannot be poisoned the way a receiving address in your history can, but a phishing page or a copy-paste slip can still hand you the wrong one. Copy it from the order page itself and paste it directly into your wallet. Anything that arrives via chat, email, or a search result is not from us, and our only official domain is simpleswap.io.

What comes next

Each entry above will get its own breakdown in "Know the Scam by SimpleSwap" over the coming months. Follow #KnowTheScam to catch every new one as it drops — phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

What is address poisoning? A crypto scam in which an attacker sends you a tiny transfer from an address engineered to look like one you use, so that the lookalike sits in your transaction history. If you later copy the recipient address from that history instead of a trusted source, your funds go to the attacker.

Why did I receive a tiny amount of crypto I did not expect? Most often, this is poisoning bait, which places a lookalike address in your history. It can also be used for wallet-clustering analysis. In either case, do not interact with it and never copy that address.

Does sending a test transaction protect me? Only partially, and the largest recorded case proves the limit. The victim's test went to the correct address, after which the attacker poisoned the history in the minutes that followed. Send the test if you like, but re-enter the address from your trusted source for the real transfer.

Can poisoned funds be recovered? Effectively never. The transaction is valid and correctly signed, so there is nothing technically wrong for anyone to reverse. In the $50 million case, even a $1 million bounty produced nothing.

Is checking the first and last four characters enough? No. Those are the exact positions attackers match. In the December 2025 case, the fake shared the first three and last four characters with the real address.

Is SimpleSwap safe from address poisoning? No exchange can be, and that is worth stating plainly rather than reassuringly. Every swap asks you for a receiving address, and if the address you paste has been poisoned, the transfer is valid and final. Nothing on our side can detect that the destination is not the one you meant. What we can do is tell you where the risk sits: paste from your own wallet or address book rather than any transaction history, and verify the middle of the string before confirming. Our only official domain is simpleswap.io, and the deposit address should always be copied directly from the order page.

Is SimpleSwap a scam? No. SimpleSwap has operated since 2018 as a self-custodial swap aggregator, moving funds between wallets you control without holding a balance in between. Two unrelated things push that phrase into search results.

The first is brand impersonation: cloned sites and fake support accounts that borrow a recognizable name in order to phish people. Our only official domain is simpleswap.io; we never message you first, and nobody at SimpleSwap will ever ask for your seed phrase.

This article is for educational purposes only and is not financial or security advice. SimpleSwap's only official domain is simpleswap.io.