Address Poisoning: How Look-Alike Wallets Fool NFT Users

Most NFT scams try to trick you into signing something. Address poisoning is different. It targets a simple habit: copying a wallet address from your own transaction history. If you send NFTs or crypto to the wrong address, the blockchain will not ask whether you meant it. This guide explains how the trick works and how to protect yourself.

What Is Address Poisoning?

Address poisoning is a scam where an attacker plants a look-alike wallet address in your transaction history. The goal is to make you copy it by mistake the next time you want to pay or transfer to someone you already know.

Wallet addresses are long strings of letters and numbers, so most apps and people only check the first few and last few characters. Attackers use software to generate an address that matches those visible characters of an address you have used before. The middle part is different, but it is easy to miss.

How the Attack Works Step by Step

1. The attacker watches the blockchain. Every transaction is public, so they can see which addresses you send to.
2. They generate a look-alike address. It starts and ends with the same characters as a real address you use, such as a friend, a collaborator, or your own second wallet.
3. They put it in your history. They send you a tiny or zero-value transfer from the fake address. Some attackers also trigger a fake transfer that appears to come from you to the look-alike address. Either way, the fake address now shows up in your activity list.
4. You copy the wrong one. Later you open your history, copy what looks like the right address, and send funds or an NFT to the attacker.

Blockchain transfers are final. There is no bank to call and no way to reverse the transaction, so prevention matters far more than recovery.

Why It Matters for NFT Creators

If you mint and sell digital art, you regularly move assets between wallets. You might send an NFT to a buyer, move a finished piece to a cold storage wallet, or pay a collaborator their share of sales. Each of these is a moment where copying from history feels convenient. Creators who use several wallets for minting, selling, and storage are especially exposed, because they often send to addresses they created themselves.

Warning Signs to Watch For

• A transaction in your history that you do not remember, especially a tiny or zero-value one.
• Unknown tokens or NFTs that appear in your wallet from an address that closely resembles one you know.
• A recipient address that looks right at the start and end but that you have not checked in the middle.

Unsolicited tokens are not a reason to panic, but treat them as a signal to slow down. Do not interact with them, and do not approve anything connected to them.

How to Protect Yourself

Never copy addresses from your transaction history

This single habit blocks most address poisoning attempts. Get the address from a source you control, such as the recipient’s own message, their profile, or your saved records.

Compare the full address, not just the ends

Before you confirm, check the beginning, the middle, and the end. If the address is long, compare it in chunks. Pasting it into a text field and reading it slowly helps.

Send a small test transaction first

For a large transfer or a valuable NFT, send a small amount to the address first and ask the recipient to confirm they received it. The extra network fee is a small price for certainty. For a one-of-a-kind NFT, you can test the same address with a low-value item or a small payment before moving the important piece.

Use an address book or a human-readable name

Many wallets let you save labeled contacts. Add an address once after verifying it carefully, then pick it from the list. Name services such as ENS can also replace long addresses with names, though you should still confirm that you have the correct name. Our guide to ENS and .eth names covers how they work.

Keep your own wallets clearly labeled

If you use separate wallets for minting and storage, give each one a clear label in your wallet app and keep a private record of the full addresses. Store this record safely, and never store your seed phrase in the same place. See how to back up your wallet safely.

Consider a hardware wallet for valuable assets

A hardware wallet shows the recipient address on its own screen. That gives you a second place to check the address before you approve. It does not stop you from confirming a wrong address, but it helps you slow down. More in our guide to hardware wallets for NFTs.

What to Do If You Sent Funds to the Wrong Address

Be realistic. A transaction on a public blockchain cannot be undone, and attackers usually move funds quickly. You can still take a few sensible steps:

• Check the transaction on a block explorer to confirm where the assets went.
• Do not trust anyone who contacts you offering to recover the funds for a fee. Recovery scams are common after a loss.
• Stop copying from history, review your wallet for other unknown activity, and check your token approvals.
• If the amount is significant, consider reporting it to the relevant authorities in your country.

Address poisoning does not steal your keys or your seed phrase. It relies on you sending assets yourself, which is why careful habits work so well against it.

Key Takeaways

Address poisoning uses look-alike addresses to exploit copy and paste habits. Get addresses from trusted sources, verify the full string, use saved contacts, and test with a small transfer when the value is high. These steps take a minute and can save you from an irreversible mistake.

If you are ready to create and manage your own collection, Simple NFT Creator lets you make and mint NFTs from your phone. It is available on the App Store and Google Play. As always, double check every address before you send anything.