An extra line in your transaction history, for zero or a few cents, from an address that starts and ends exactly like one you send to all the time: it may be an address-poisoning attempt. The scam relies on placing a lookalike in your history so you copy it next time, believing it is the address you know. Don’t copy from that line. Go back to the receiver’s current wallet receive screen or exchange deposit page, take the full address and the network from there, and compare it character by character.
If the line is already sitting in your history, start with how to read it. If you are about to send and aren’t sure of the address, go to the check before sending.
Why a lookalike address appeared in your transaction history
imToken’s scam alert on addresses with the same last characters, read in October 2026, describes the habit this relies on: people copy a recipient from their history. The scammer generates an address with matching final characters and sends a small amount from it, so that address lands in the victim’s history. The pair in that alert is TPE8q6WPYF...7sAWsbYd and TPE8Ap2bx2..WsAWsbYd. Both open with the same four characters and close with sAWsbYd; the long stretch in between is different.
The bait doesn’t have to be real money. Etherscan’s note on the zero-value token transfer attack covers a version that uses transfers of zero tokens to put a similar-looking address in front of you. Ledger’s help page widens the list to received transactions, NFTs and dummy “sent” or fee entries, and says these scams are most common on low-fee chains such as Polygon, Tron, Tezos, Solana and BNB Smart Chain, though they can happen on any chain.
None of this requires your private key. Ledger explains that the scammer works from public blockchain data and pays the fee for that small transfer, and Etherscan says that seeing muted transfers doesn’t mean your keys are compromised. That only covers the poisoning entry itself. If your balance has actually dropped, a non-zero transfer went out that you didn’t start, or you have exposed your recovery phrase or signed a suspicious approval, look into that transaction and your account security separately rather than filing it under poisoning.
How to read a suspicious line in your wallet or block explorer
Open the line in your wallet or explorer and go through it one field at a time, with the address you really use open alongside it.
- The amount. A zero-value or unexpectedly small transfer. Ledger’s typical example is an unexpected small amount of USDT from an address similar to yours. If nobody arranged this money with you, put it on the suspicious side for now.
- The middle of the address. Wallet lists usually show a few characters at each end and fold the rest behind an ellipsis, which is the part this trick depends on. Open the details to get the full string, bring up the full version of your real address, set the two one above the other and go from the first character to the last. Matching ends with a different middle means a different address, and it can’t stand in for the one the receiver gave you.
- Direction and time. Ledger also mentions bogus “sent” entries showing interaction with an unfamiliar address. If a line says you sent something at a time you never touched the wallet, compare the full address the same way. On Etherscan’s Token Transfers tab, also check the rows directly above and below the one you are working from, because the imitation can sit on either side of the real entry.
- Any warning on the page. Etherscan dims zero-value token transfers and adds a grey warning icon. In imToken, “Hide risky transactions” is on by default, so an entry may be missing from your list simply because the app folded it away; the same alert says the app also shows a reminder when you copy an address.
Suppose you send USDT to one address every week, and one day a transfer of a few cents appears beneath your latest payment from what looks, shortened, like that same address. The easy way to settle it isn’t to work out where those cents came from. Find the address the receiver originally gave you and hold it against the full address on this line. If they differ, do not use that entry as the destination for your next payment.
How to verify a recipient address before you send
Keep transaction history out of the address-copying step: get the destination from the receiver’s current receive screen or deposit page. The three sources above say the same thing in the language of their own tools.
- Take the address from the original. Paying someone else, use the copy they sent you from their own wallet or deposit page. Moving funds to your own Ledger, Ledger’s advice is to use the Receive tab in Ledger Wallet rather than paste from history. If the receiver uses an exchange account, ask them to copy it again from the deposit page and to name the network with it. Our guide to finding a Binance deposit address shows what each field on that page is for.
- Save addresses you use often. imToken recommends its address book, under “My Profile” then “Address Book”. On an exchange, add regular destinations to the withdrawal address whitelist and pick from the list instead of pasting. Check the full address and network before saving it; if the saved entry is wrong, selecting it again repeats the mistake.
- Check every character. Ledger is explicit that the first and last few aren’t enough, and that hardware wallet users should confirm the address on the device itself. A slow method works well here: put the original beside what you pasted, split them into groups of four, read each group aloud against the original, and only confirm after the last group.
- For a large amount, send a small test first. Look up the receiver’s minimum deposit and the transfer cost before deciding, then have the receiver confirm arrival from inside their own account. A test only proves that one transfer arrived. For the remaining balance, check the full address and network again, and don’t reach for the entry that has just appeared in your history.
imToken’s alert puts it plainly: once a transfer succeeds it cannot be cancelled or changed. The check has to happen before you submit, because there is no undo waiting afterwards.
A poisoned transaction is already in your history: should you do anything?
Do not send the unexpected amount back or interact with the suspicious address. The record remains on the chain, but you can keep it out of future transfers: label the real address, save it in your address book, and only take recipients from there or from the original.
In imToken, leave “Hide risky transactions” on. On Etherscan, watch for those dimmed rows with the grey icon. After moving to a new wallet or a new phone, don’t treat anything in the old wallet’s history as a reliable source, whichever app you use.
Ignore anyone who offers to “clean” a contaminated address or remove the risk by having you connect your wallet, sign an approval or pay a fee. Ledger’s own warning applies here too: never share your recovery phrase with anyone.
You already sent funds to the lookalike address: what you can still do
Because a successful on-chain transfer can’t be cancelled or changed, the wallet or exchange you sent from can’t reverse it just because you ask, if the address belongs to a scammer. What you can do is gather the material that official support or the police would need to look at where the funds went:
- the transaction hash, plus the status and time shown on the block explorer (see how to check a transaction hash and confirmations);
- a screenshot of the poisoned entry you copied from, with the full address visible;
- the receiver’s genuine address, as originally given, to show the two differ.
If the funds left an exchange account, take these to support through the official app or website. For a significant sum, you can also report it to your local police. Neither step guarantees the money comes back, and any person or company claiming they can “recover” on-chain assets for an upfront fee shouldn’t be trusted.