Crypto address poisoning: look-alike addresses and the test-payment trap

Address poisoning hacks nothing: it counts on you copying an address from your wallet's transaction history after a scammer has slipped in a fake that resembles one you've paid. In December 2025 a trader lost 49,999,950 USDT, Tether's dollar stablecoin, this way, 26 minutes after sending a 50 USDT test. Here is how it works, why checking the first and last few characters doesn't stop it, and what does.

How the trick works

On Ethereum and chains built like it, such as Binance Smart Chain (BSC), an address is "0x" and 40 hexadecimal characters: the digits 0 to 9 and the letters a to f. Nobody memorises one, so people copy and paste, often from recent transactions, and wallets shorten addresses on screen to the first and last few characters.

Poisoning software watches the chain for transfers, usually of stablecoins, and brute-forces a vanity address, one made to order by trying random keys, with the same ends as an address the victim has used. A 2025 study led by Carnegie Mellon University researchers describes three ways it then plants that look-alike in the victim's history:

• Dust: the look-alike sends you a tiny amount of the same token.
• A zero-value transfer: popular token contracts let anyone record a transfer of zero tokens from any address, so your history seems to show you paying the look-alike.
• A counterfeit token: a token the attacker created, named to look like the real one, appears to move the same amount as your real payment.

None of this needs access to your wallet, unlike the account takeovers in CS2 gambling scams. It needs one mistake, pasting the wrong address, and blockchain transfers can't be reversed.

Why the ends are cheap to fake

Each hexadecimal character has 16 possible values, so a random address matches d chosen characters of a target with a chance of 1 in 16^d, and an attacker needs 16^d tries on average. The study measured a publicly available tool producing about 516 million addresses a second on one graphics card. At that rate, imitating one particular address takes:

| Characters matched after the 0x | Average tries | Average time | |---|--:|--:| | First 3 and last 4 | 268 million | about half a second | | First 4 and last 4 | 4.3 billion | about 8 seconds | | First 5 and last 5 | 1.1 trillion | about 35 minutes | | First 6 and last 6 | 281 trillion | about 6 days | | All 40 | 1.5 × 10⁴⁸ | about 9 × 10³¹ years |

Times are rounded; an attacker matching thousands of targets at once goes faster still. Each extra character you check multiplies the work by 16, so the ends are the cheap part to fake and the middle is where a look-alike gives itself away.

The test-payment trap

A small test payment first is common advice, and the guide to crypto deposits and withdrawals suggests it too. The December 2025 trader was moving USDT from an exchange to their own wallet. Etherscan, a site that shows every Ethereum transaction, records what followed on 19 December:

The real address began 0xbaf4 and the fake 0xbaff, and both ended in f8b5, a match that takes about half a second on the graphics card above. Within half an hour the thief had swapped the USDT for DAI, a stablecoin without the freeze Tether can apply to USDT, and nearly all of it went into Tornado Cash, a mixer that hides where coins go.

The study found poison mostly arrives within 20 minutes of the transfer it imitates, but the mistake can come much later. Bitquery, a blockchain data company, measured a median of 4.5 days from bait to theft on Ethereum in the year to July 2026. On 30 January 2026 a wallet that had been dusted for months sent 4,556 ether, worth more than $12 million at the time, to a look-alike of an address it had paid before.

A test still shows the address works. Copy the main payment's address from its source again, though, not from the entry the test left in your history.

How common it is

The Carnegie Mellon study counted more than 270 million poisoning attempts aimed at over 17 million addresses on Ethereum and BSC between July 2022 and June 2024. Attackers succeeded 6,633 times across both chains, taking at least $83.8 million; on Ethereum, that was about 1 success per 10,000 poisoning transfers. The median theft was $2,169 on Ethereum and $85 on BSC, where an attempt cost about a cent against about a dollar on Ethereum.

Cheaper fees mean more poison. After an Ethereum upgrade cut fees on 3 December 2025, Etherscan counted 29.9 million USDT transfers worth under a cent in the next 90 days, against 4.2 million in the 90 days before, and said a large share looked like poisoning. Bitquery counted 1,635 people on Ethereum who lost $76.1 million in the year to July 2026; in 28.3% of the thefts the fake imitated the victim's own exchange deposit address, and in 3.8% a gambling address. Bitquery's point: the addresses you've paid before are the ones you stop checking.

Other chains aren't immune. TronLink, a Tron wallet, warns of "similar address" scams planted with tiny USDT transfers such as 0.001 USDT. Bitcoin addresses are rarely reused, which gives poisoners less to copy, yet an April 2025 analysis by Jameson Lopp, Casa's chief security officer, found about 48,000 suspected poisoning attacks on Bitcoin since 2023.

Habits that stop it

1. Copy addresses from their source, never from history. For a deposit that's the site's deposit page; for a withdrawal, your own wallet's receive screen. On cs2.casino each account gets its own deposit addresses, so copy yours from the deposit page each time.
2. Save the addresses you reuse. Check one in full once, store it in your wallet's address book and pick it from there, as MetaMask, TronLink and Etherscan all advise.
3. Check the middle after you paste. Compare the pasted address with the source, middle characters included. This also catches clipboard malware, which swaps a copied address for the attacker's as you paste; MetaMask suggests pasting your own address into a text editor to test for it.
4. Treat surprise transfers as possible bait. An unexpected tiny deposit, zero-value transfer or unknown token is how a fake gets into your history. Hide them where your wallet or explorer allows; Etherscan hides zero-value transfers by default.
5. Stop at look-alike warnings. MetaMask now shows a blocking warning before a send to an address that closely resembles one you've used, such as the same first and last four characters with a different middle, and warns before any first-time send.

Withdrawals need the same care. cs2.casino pays withdrawals in crypto and confirms each with a code sent to your verified email, but the coins go to whatever address you paste. If you start with a small withdrawal, as the checklist for a new site suggests, take your address for the next one from your wallet's receive screen again.

If it has already happened

A confirmed transfer can't be pulled back, and in both cases above the thief moved the coins on within the hour. In the US, report it to the FTC at ReportFraud.ftc.gov; elsewhere, the right place differs by country.

Then expect offers of help. The FTC warns that recovery scammers buy lists of people who have already lost money and contact them promising to get it back for an upfront fee. Anyone who does that is a scammer, and paying only adds to the loss.

Sources

• Blockchain Address Poisoning (USENIX Security 2025) — USENIX
• Address Poisoning Attacks Are Rising on Ethereum — Etherscan Information Center
• Crypto trader loses $50 million in address poisoning attack, offers $1 million bounty for return — The Block
• Address poisoning on Ethereum: $76 million stolen in a year — Bitquery
• Address poisoning scams — MetaMask Help Center
• Clipboard hacking — MetaMask Help Center
• How to stay away from address poisoning scams? — TronLink Support
• Refund and Recovery Scams — FTC Consumer Advice