Address poisoning and zero-value transfers: when your own history robs you

Why random tokens appear in your wallet

Anyone can send any token to any address without permission. Attackers script mass transfers to hundreds of thousands of wallets at once; on BNB Chain this costs a fraction of a cent per recipient. The tokens carry names designed to attract a click: brand impersonations, fake reward names, or URLs promising an airdrop.

The dust has three possible jobs:

• Bait. The token name is a URL or a promise. You visit, connect your wallet, sign an approval, and a drainer contract empties you. The signature is the theft — not the token.
• Poisoning. The sender address is a deliberate lookalike of one you already use. This is the dangerous one.
• Deanonymisation. Mass dusting, then watching which addresses consolidate, to cluster wallets belonging to the same person.

The poisoning mechanic

Wallets abbreviate addresses. You see 0xa78f4780…23cDEcDE4, never all 42 characters. Attackers exploit this precisely:

1. 1They watch the chain

   For a transfer between two addresses — say, you sending USDT to your exchange deposit address.

2. 2They brute-force a vanity address

   One whose first four and last four characters match your destination exactly. On consumer hardware this takes minutes, because they are matching eight characters, not forty.

3. 3They push a transfer into your history

   From that lookalike — zero-value, dust, or a fake token. It now sits in your recent activity, one row from the real one.

4. 4They wait

   Days or weeks. No further contact.

5. 5You send again

   You scroll your history, see the familiar-looking address, copy it, paste it, and send real funds to the attacker. Irreversibly.

Defences that actually work

1. 1Never copy an address from transaction history. This is the whole attack. Break this one habit and address poisoning cannot touch you.
2. 2Verify the middle, not the ends. First four and last four are exactly what the attacker matched.
3. 3Send a test transaction for large transfers. A dollar first, confirm it arrives, then send the rest.
4. 4Hide spam instead of engaging. Do not try to sell, swap or “return” unknown tokens — interacting is the risk.
5. 5Never connect your wallet to a site named inside a token. That is the entire purpose of the token's name.
6. 6Audit your approvals periodically. A forgotten unlimited allowance from two years ago is a live key to your funds.
7. 7Use fresh deposit addresses where your platform issues them. A rotating address gives an attacker nothing stable to impersonate.

Why this hits P2P merchants hardest

Merchants send outbound USDT dozens of times a day, often to the same handful of addresses, usually in a hurry, frequently from a phone. That is the ideal victim profile: high frequency, repeated destinations, and a workflow that rewards copying from history.

The full payout discipline is in the P2P merchant survival guide.

If you already sent to a poisoned address

The transfer is irreversible — nobody can undo it, and any service claiming otherwise is a follow-up scam. What you can still do:

• Record the transaction hash and attacker address immediately.
• If the funds moved to a centralised exchange deposit address, report it to that exchange with the hash — they can sometimes freeze.
• File formally. In India: the cybercrime portal and 1930 helpline, within 24 hours if possible.
• Delete the poisoned entry from saved contacts and audit the rest.