Address poisoning: the look-alike address scam and how to avoid it

How the scam works

MetaMask describes it in three steps (MetaMask Help Center). You send an ordinary transaction — to a friend, or to another account of your own. A scammer running software that watches transfers of certain tokens, usually stablecoins, notices it. They use a vanity address generator to create an address that closely matches yours or your contact’s, and send you a transaction of negligible value from it — usually a transfer of zero tokens.

Nothing has been stolen at that point. The transfer’s only job is to sit in your history, next to the real address, looking almost the same.

Why it works

Addresses are long, so wallets and explorers shorten them. Often you see only the first characters, or the first few and the last few with the middle skipped — and, as MetaMask notes, that is how most people recognise an address. A generated look-alike only has to match those visible parts. The next time you copy “the usual address” out of your history, you may be copying the scammer’s.

How to avoid it

MetaMask’s advice (MetaMask Help Center):

• Check the whole destination address before sending, especially for large amounts — the middle characters, not only the start and the end.
• Save addresses you use often in the address book once you have verified them, and send from there.
• Do not copy addresses from your transaction history.
• Use a hardware wallet, since most of them make you confirm the destination on the device itself. Ledger’s own guide describes the same check on the receiving side: compare the address on the device’s screen with what the app shows (Ledger).

What the wallet does about it

MetaMask compares a destination address against your transaction history. If it closely resembles an address you have used before, it shows a blocking warning before the transaction is sent; if it is an address you have never interacted with, it warns you about that too (MetaMask Help Center). The detection is live on MetaMask Mobile and Extension across EVM networks (MetaMask). A warning helps only if you read it: the scam is designed for the moment you are sure you are sending to the right place.

If you have already sent funds

MetaMask is direct about it: confirmed on-chain transactions cannot be altered, so funds lost this way are irretrievable (MetaMask Help Center). What remains in your control is the next step. Whoever then offers to get the money back and asks for your recovery phrase or private keys is, in MetaMask’s words, trying to steal all of your assets (MetaMask Help Center). More on that pattern is in wallet drainers.