Address Poisoning: The $68M Attack Pattern

In May 2024, an address poisoning attack stole $68 million in a single transaction. The victim copied an address from their transaction history — but it was a fake, planted there by an attacker.

How It Works

The attacker monitors the blockchain for large transfers

They generate a vanity address that matches the first and last characters of the real recipient

They send a tiny transaction (dust) FROM that fake address TO the victim

The fake address now appears in the victim transaction history

Next time the victim copies an address from history, they grab the fake one

Funds sent to the fake address are gone permanently

Why It Works

Most wallet interfaces truncate addresses, showing only the first 6 and last 4 characters. The attack exploits this UI pattern — if the start and end match, users assume it is the same address.

Scale of the Problem

Address poisoning is not rare. Millions of dust transactions are sent daily across EVM chains and TRON. Most go unnoticed because the amounts are tiny ($0.01 or less). But each one plants a trap.

How to Detect It

AML screening tools can flag address poisoning in two ways:

Dust detection — hundreds of micro-transactions from unfamiliar addresses is a signature pattern

Poisoned address databases — community-reported poisoning addresses are catalogued and flagged

When you screen an address and see a dust attack pattern in the results, that is your early warning system.

---

Sanctuary detects dust attacks and address poisoning patterns automatically. Check any address free.