Phishing and address poisoning in crypto

What is crypto phishing?

Phishing is any attempt to get you to hand over something valuable by pretending to be someone you trust. In crypto, the valuable thing is usually one of three: your seed phrase, the password and code for an exchange account, or a wallet signature that grants spending rights.

CISA's warning signs apply directly: urgent or emotional language, requests for personal or financial information, shortened links and web addresses that are one letter off, like CISA's example "amazan.com". Ethereum.org adds crypto-specific versions: clone sites with identical layouts, fake airdrops that link to scam pages, and spoofed link previews in social media ads. Its advice is to check that you are on the right domain, especially after clicking a link.

The scale is large. The FBI's IC3 logged 191,561 phishing and spoofing complaints in 2025 across all sectors, not only crypto.

How does address poisoning work?

An Ethereum address is 40 hexadecimal characters after the 0x prefix, derived from a public key, according to ethereum.org. Nobody memorizes that, so people copy addresses from their own transaction history. Address poisoning exploits that habit.

Researchers at Carnegie Mellon, in a peer-reviewed USENIX Security 2025 paper, describe the attack in three steps. The attacker watches who you transact with, generates a new address whose first and last characters match that counterparty's, and then sends you a transaction from it so it appears in your history. The paper identifies three kinds of poisoning transfer: zero-value transfers, tiny transfers and fake token transfers.

Two features of the ERC-20 token standard make this possible. It states that transfers of 0 values must be treated as normal transfers and must emit a transfer event, so a worthless transaction still shows up in explorers and wallets. And, as ethereum.org notes, anyone can deploy a token contract with the same name and symbol as a real one, and the contract itself writes the transfer events, so a fake token can produce convincing-looking entries.

Why does checking the first and last characters fail?

Each hexadecimal character has 16 possible values. If you only check the first four and last four characters after 0x, the attacker needs an address matching just 8 characters.

This is why ethereum.org's instruction is to make sure the address you are sending to exactly matches the recipient's, not that it looks similar. Once sent, an Ethereum transaction is irreversible: unless you know the owner and they agree to return the funds, they are gone.

How do phishing, address poisoning and fake airdrops differ?

How can you protect yourself from address poisoning?

1. Save trusted addresses. Use your wallet's address book or allowlist feature, if it has one, for people and services you pay regularly. The CMU researchers recommend allowlisting trusted addresses.

2. Never copy from your history. Get the address from the source each time: the recipient, your saved contact or the exchange's deposit page.

3. Check every character, or at least far more than the ends. Read it in chunks and compare against a copy you trust.

4. Treat unexpected transfers as warnings. A zero-value or tiny incoming transaction from a near-copy of a known address is a sign someone is targeting you.

5. Ignore unknown tokens. Ethereum.org warns that scam airdrops lead to sites that ask for signatures; see token approvals and wallet drainers.

For exchange accounts, add phishing-resistant login protection with two-factor authentication.

What mistakes make address poisoning succeed?

• Trusting your own history. Anyone can place an entry in it. A row in your transaction list says nothing about who controls that address.
• Checking only the ends. The attack is designed around exactly that shortcut.
• Assuming a hardware wallet will catch it. The device signs what you ask. If you paste the wrong address, it signs the wrong address; see hardware vs software wallets.
• Hurrying. CISA lists urgent, pressured language as a classic phishing marker. A transfer that "must" go out in the next few minutes deserves the slowest check of all.
• Searching for a recovery service. Ethereum.org says no one can reverse blockchain transactions; paid recovery offers are a second scam.