A client contacted us in distress. He had sent 12 ETH (worth approximately $38,000) to what he believed was his regular exchange deposit address. He had copied the address from his transaction history — an address he had used many times before. But the ETH never arrived at the exchange. It went to a different address — one that looked almost identical to the exchange's deposit address but had two characters transposed. The client had been the victim of an address poisoning attack, and his 12 ETH was gone.

This type of attack is alarmingly common. In 2024 alone, address poisoning attacks resulted in over $70 million in losses, including a single attack where a victim sent $68 million in wrapped Bitcoin to a poisoned address. The attack is simple to execute, difficult to detect, and often results in total loss — because the recipient address is controlled by the attacker and the funds are moved immediately.

In this article, I explain two related but distinct attacks: dusting attacks and address poisoning. Both involve tiny transactions sent to a victim's wallet, but they serve different purposes. Dusting is primarily a deanonymization tool — it aims to break the privacy of wallet clusters by linking addresses. Address poisoning is a fraud tool — it aims to trick the victim into sending funds to the wrong address. Understanding both is essential for anyone who holds or transacts in cryptocurrency.

What is a dusting attack?

A dusting attack is when an attacker sends a very small amount of cryptocurrency (called "dust") to a large number of wallet addresses. The amounts are so small that they are typically below the transaction fee required to spend them — hence the name "dust." The purpose of the attack is not to steal the dust itself (it is worthless) but to deanonymize the wallet addresses that receive it.

Here is how the deanonymization works: cryptocurrency wallets manage multiple addresses, and these addresses are linked through a process called "common input ownership heuristic." When a wallet sends a transaction, it often uses multiple addresses as inputs (to combine enough funds for the transaction). If address A and address B are used as inputs in the same transaction, it is likely that they are controlled by the same wallet. Blockchain analytics tools (Chainalysis, TRM Labs) use this heuristic to cluster addresses into groups controlled by the same entity.

In a dusting attack, the attacker sends dust to many addresses. When the wallet's owner later sends a transaction, the wallet software may include the dust as an input (to combine it with other funds). When the dust is combined with other addresses in a transaction input, the analytics tools link those addresses together — and the attacker (who knows which addresses received dust) can observe the linking and build a map of the wallet's address structure.

The goal is to break the privacy of the wallet owner. If the attacker knows that addresses A, B, C, and D are all controlled by the same wallet, they can track all transactions from those addresses and build a profile of the wallet's activity. If any of those addresses has been linked to a real-world identity (e.g., through a KYC exchange deposit), the attacker can identify the wallet owner.

Dusting attacks are most common on Bitcoin and Ethereum, but they also occur on other blockchains. On Bitcoin, dust attacks are typically executed by sending 500-1000 satoshis (0.000005-0.00001 BTC, worth less than $1) to thousands of addresses. On Ethereum, the attacker sends small amounts of ETH or tokens (0.0001-0.001 ETH) to target addresses.

What is address poisoning?

Address poisoning is a more dangerous attack that has become prevalent in 2023-2024. Unlike dusting, which is a privacy attack, address poisoning is a direct fraud attack — the goal is to trick the victim into sending cryptocurrency to the attacker's address.

The attack works like this:

  1. The attacker monitors the blockchain for transactions from the victim's wallet. When the victim sends a transaction to an exchange (or any regular recipient), the attacker observes the transaction.
  2. The attacker generates a vanity address that has the same first 6-8 characters and the same last 6-8 characters as the recipient address. For example, if the victim sent funds to 0xABC123...DEF456, the attacker generates an address like 0xABC128...DEF460. Generating an address with matching first and last characters is computationally feasible (it takes a few hours on a standard computer).
  3. The attacker sends a zero-value or dust transaction from this vanity address to the victim's wallet. The transaction appears in the victim's transaction history, typically immediately after the legitimate transaction.
  4. When the victim later wants to send another transaction to the same recipient, they scroll through their transaction history to find the recipient's address. They see two transactions with very similar-looking addresses — the legitimate one and the poisoned one. If the victim copies the wrong address (the poisoned one), the funds go to the attacker.

The attack exploits the fact that cryptocurrency users routinely copy addresses from their transaction history rather than bookmarking them or using address books. Because the poisoned address has the same first and last characters as the legitimate address, it looks identical at a glance — users rarely check the middle characters of an address.

The attack is particularly effective on Ethereum, where addresses are 42 characters long (0x followed by 40 hexadecimal characters). An attacker can generate an address with matching first and last 6 characters in a few hours, and the resulting address looks very similar to the original. On Bitcoin, the attack is harder because Bitcoin addresses use a checksum that makes vanity address generation more computationally expensive, but it is still feasible.

Real-world cases of address poisoning

The most famous address poisoning case occurred in May 2024, when a victim sent 68 million wrapped Bitcoin (wBTC) to a poisoned address. The attacker had generated an address that matched the first and last characters of the victim's usual exchange deposit address. The victim, who had previously sent wBTC to the exchange, copied the wrong address from their transaction history. The $68 million was moved by the attacker within minutes, converted to ETH, and dispersed across multiple wallets. As of 2025, the funds have not been recovered.

In another case, a victim lost $2.1 million in USDT to an address poisoning attack on the Tron blockchain. The attacker had monitored the victim's previous USDT transfers and generated a Tron address with matching first and last characters. The victim copied the poisoned address from their transaction history and sent $2.1 million to it. The attacker immediately converted the USDT to other cryptocurrencies and moved it through cross-chain bridges.

These cases share a common pattern: the victim was an experienced crypto user who had made many transactions, and the attack exploited their routine of copying addresses from transaction history. The victims did not realize that a poisoned address had been inserted into their transaction history.

How to protect yourself from address poisoning

Address poisoning is preventable with proper security practices. Here are the key protections:

How to protect yourself from dusting attacks

Dusting attacks are less directly harmful than address poisoning (they do not steal your funds), but they compromise your privacy. Protections include:

The forensic impact of dusting

From a forensic perspective, dusting attacks complicate blockchain tracing in two ways. First, they increase the number of addresses associated with a wallet, making the transaction graph more complex. This can slow down tracing because the analyst must sort through more transactions to identify the relevant ones. Second, if the victim of a dusting attack consolidates the dust with their other funds, the analytics tools may incorrectly link the victim's address with other addresses that received dust from the same attacker — leading to false positives in the clustering.

In fraud recovery cases, this can be a problem. If the scammer used a dusting attack on their own wallets before moving the stolen funds, the analytics tools may produce incorrect clusters, leading the tracer down the wrong path. Experienced forensic analysts know to account for this — they look for dusting patterns and exclude dust transactions from the clustering analysis.

In one case I handled, the scammer sent dust from 50 different addresses to their own wallet before moving the stolen funds. The analytics tool initially clustered all 50 dust addresses as belonging to the same entity (the scammer), creating a misleading transaction graph. Our forensic team identified the dusting pattern, excluded the dust transactions from the analysis, and traced the stolen funds to the correct destination — a Binance deposit address. Without the dusting analysis, we would have followed the wrong trail.

The relationship between dusting and AML compliance

Dusting attacks also have implications for AML compliance. If your address receives dust from a sanctioned address (e.g., an OFAC-designated address), your address may be flagged by blockchain analytics tools as having a connection to a sanctioned entity. This can result in your address being frozen by exchanges or stablecoin issuers — even though you did nothing wrong and did not initiate the transaction.

This is a variant of the "false positive" problem we discussed in our stablecoin freeze guide. If your address is flagged because of incoming dust from a sanctioned address, you may need to go through the appeal process with the relevant exchange or stablecoin issuer to unfreeze your funds. Document the incoming dust transaction (which you did not initiate) and provide it as evidence that the flagged transaction was not your doing.

In one case, a client's USDT was frozen by Tether because the client's address had received a small amount of USDT (worth less than $1) from an address that was later designated by OFAC. The client had no connection to the sanctioned entity — the dust was an unsolicited transaction that the client could not prevent. We filed an appeal with Tether, providing blockchain evidence that the incoming transaction was unsolicited and that the client had no connection to the sanctioned address. Tether unfroze the address after 3 weeks.

How attackers generate vanity addresses

The address poisoning attack relies on the attacker's ability to generate a cryptocurrency address that matches the first and last characters of the victim's usual recipient. This is done through a process called "vanity address generation" — using computational power to generate many random key pairs until one produces an address with the desired prefix and suffix.

On Ethereum, addresses are derived from the public key using the Keccak-256 hash function. The last 20 bytes of the hash become the address. To generate an address with a specific prefix and suffix, the attacker generates random private keys, computes the corresponding addresses, and checks if they match the desired pattern. For a 6-character prefix and 6-character suffix match, the expected number of attempts is approximately 2^48 (about 281 trillion). Using modern GPUs, this can be computed in a few hours — tools like Profanity (now deprecated due to a security vulnerability) and its successors can generate matching addresses in under an hour on consumer hardware.

On Bitcoin, address generation is more computationally expensive due to the different address format (Base58Check encoding with a checksum). Generating a Bitcoin address with matching first and last characters takes significantly more computational power, which is why address poisoning attacks are more common on Ethereum and Tron than on Bitcoin.

Once the attacker has generated the vanity address, they use it to send a transaction (typically zero-value or a very small amount) to the victim's wallet. This transaction appears in the victim's transaction history, creating the poisoned address that the victim may later copy by mistake. The attacker monitors the vanity address for incoming funds — if the victim sends cryptocurrency to it, the attacker immediately moves the funds to avoid recovery.

The role of wallet software in preventing attacks

Wallet software plays a critical role in both enabling and preventing address poisoning attacks. The vulnerability exists because many wallet interfaces display transaction history in a way that makes it easy to copy addresses — typically with a "copy address" button next to each transaction. If the user copies the wrong address, the attack succeeds.

Some wallet developers have begun implementing protections against address poisoning:

Despite these improvements, the primary defense remains user awareness. No wallet software can fully prevent a user from copying the wrong address — the user must verify the address before sending. The best practice is to never copy from transaction history and to always use the exchange's deposit page or an address book.

What to do if you have been poisoned

If you have sent cryptocurrency to a poisoned address, time is critical. The attacker will typically move the funds within minutes of receiving them. Take these steps immediately:

In the case I described at the beginning of this article, the client's 12 ETH was traced to a decentralized exchange (Uniswap) where it was swapped for USDC. The USDC was then sent to a Binance deposit address. We filed a freeze request with Binance and, because the request arrived before the USDC was withdrawn, the funds were frozen. The client recovered 11.2 ETH (93% of the loss — the 7% loss was from swap fees and slippage on Uniswap). The speed of the response was critical — if we had been 30 minutes slower, the funds would have been withdrawn from Binance and the recovery would not have been possible.

The bottom line

Dusting attacks and address poisoning are two of the most common threats in cryptocurrency. Dusting is primarily a privacy attack — it aims to deanonymize wallet addresses by linking them through small transactions. Address poisoning is a fraud attack — it aims to trick victims into sending funds to a look-alike address. Both are preventable with proper security practices: never copy addresses from transaction history, use address books, check full addresses, and send test transactions first.

If you have been a victim of an address poisoning attack, contact us. We can trace the stolen funds and pursue recovery through freeze requests, Norwich Pharmacal orders, and law enforcement coordination. The key is speed — the attacker will move the funds quickly, so immediate action is essential.

N. Silinevics
Nils Silinevics Crypto Compliance Counsel · Former FIU Investigator · Valken Legal AG