The First Six and Last Six Characters Matched

At 02:11 UTC on January 19, 2025, a small transaction landed in block 879,853. One input, one output. An address holding 443 satoshis sent 330 satoshis, and the remaining 113 went to fees. The receiving address was bc1qr9xkxanfstzqpfd5ce0t3evwc45pnmsr2wua0h. The sending address was bc1qr9wuw4zkjflet80lr9cr5ec8620c4fg52wua0h.

Put the two side by side and the leading bc1qr9 and the trailing 2wua0h are identical. The thirty characters in between differ. The owner of the receiving address now had a record in their wallet of money arriving from an address that looked exactly like their own at both ends.

Fifty-three days later, at 09:46 on March 13, a 1 BTC coin at the receiving address was spent. Of it, 0.1 BTC went to the lookalike address. The next day that 0.1 BTC was moved on again. This is address poisoning.

How a Fake Record Gets Planted

The attack has three steps. First, generate an address that shares a few characters at the start and end with the target. Next, send the target a tiny amount from it, leaving the fake address in the target's transaction history. Then wait. The attacker is waiting for the day the target copies an address out of their history instead of checking it fresh.

Making a lookalike address takes no special skill. Generate a random key, compute the address, and repeat until the characters you want appear. A Bech32 address has 32 possible values per character, so each additional character to match multiplies the work by 32. In the case above, bc1q is shared by every SegWit v0 address, so what the attacker actually matched was r9 at the front and six characters at the end, eight in all. 32 to the eighth power is about 1.1 trillion. That is well within reach of a single computer. Nine characters is 32 times more, ten is 32 times more again. The habit of checking four or five characters at each end sits squarely inside the cost an attacker can afford.

There is one more thing. The last six characters of a Bech32 address are its checksum, the value that detects typos. The spot people check most is that checksum, and a lookalike address is not a typo. It was generated correctly from the start, so its checksum is valid too. The wallet shows no warning at all.

Why the Attack Is Rare on Bitcoin

In April 2025, Jameson Lopp of Casa scanned the entire Bitcoin blockchain for traces of this attack. He looked for transactions with one input and one output where the first four and last four characters of the input and output addresses matched. The first trace was in block 797,570 on July 7, 2023. Around 48,000 more followed through January 2025.

He counted what the attackers spent as well. The tiny amounts sent to victims totaled 0.0684 BTC and the fees 0.2231 BTC, about 0.29 BTC together. In block space, that is about four blocks' worth. And the confirmed successes numbered one: the 0.1 BTC described at the top. The addresses that received poisoning transactions were P2PKH, P2SH and P2WPKH. No Taproot (P2TR) addresses appeared. Lopp concluded that the attack is only economical when fees are low.

Where the attacker's funds came from in that first case is also on the blockchain. A single transaction on November 12, 2024 created 1,401 outputs at once, 832 of them worth 443 satoshis. The 443 satoshis in the lookalike address was one of them. That transaction paid 2.67 satoshis per vB, and the poisoning transaction two months later paid 113 satoshis for 109 vB, about 1 satoshi per vB. Once fees climb to tens of satoshis per vB, each poisoning costs thousands of satoshis. Paying that tens of thousands of times for a single success is not a business that works.

The underlying reason the attack is expensive on Bitcoin is that a zero-value record cannot be made. To leave anything in a history, you have to create an output that holds real coins, and Bitcoin Core does not relay outputs that are too small. That cutoff is called the dust limit. Core's source defines it simply: an output is dust if the fee to spend it would exceed its value. At the default dust fee rate of 3 satoshis per vB, the limit is 546 satoshis for a P2PKH output and 294 satoshis for P2WPKH, both written in the source comments. The same formula gives 330 satoshis for P2TR. The attacker in the case above sent exactly 330 satoshis. The receiving side was P2WPKH, so 294 would have relayed, but the attacker sent a little more.

Why It Is Common on Ethereum

On account-based blockchains the situation is different. An Ethereum token transfer can be recorded with a value of zero, and anyone can create a fake token and send it to leave a same-named token entry in a history. The attacker pays only gas. This is why Etherscan hides zero-value token transfers by default and labels fake tokens.

A Carnegie Mellon team measured two years of address poisoning on Ethereum and BNB Chain and published the results at USENIX Security 2025. They found 270 million attack attempts against 17 million targeted addresses, 6,633 cases where victims actually sent money, and 83.8 million dollars in confirmed losses. Poisoning transfers were far more frequent on BNB Chain, where fees are cheaper. Bitcoin's 48,000 against Ethereum's 270 million: that gap is the difference in cost structure.

The large losses have mostly come from this side. On May 3, 2024, one person sent 1,155 WBTC, about 70 million dollars at the time, to a lookalike address. That case ended unusually, with the attacker returning most of the funds, by then converted to ether, about a week later, but such endings are the exception. In December 2025, a loss of about 50 million dollars in USDT was reported. According to reports, the victim first sent a small test payment, and immediately afterward the attacker sent a tiny amount from a lookalike address to poison the history. The victim confirmed the address with a test payment, then copied it from the history for the real one. A careful habit became the attack's way in.

The Other Thing Dust Does

Unwanted tiny deposits were a problem on Bitcoin long before address poisoning. This kind is not about stealing money but about working out who is who. It is usually called a dusting attack.

A Bitcoin wallet holds not a balance but UTXOs, pieces of unspent coin. When sending, the wallet picks a few of these pieces and bundles them as the inputs of one transaction. Blockchain analysis exploits exactly this point. It assumes the inputs of a transaction usually belong to the same person (the common-input-ownership heuristic). Apart from exceptions such as payjoin, where the recipient adds a coin of their own, the assumption is usually right. If someone drops a tiny amount into my address, the moment my wallet spends it together with other coins, different addresses get tied to one person.

Bitcoin Core added a wallet option aimed at this problem, avoid_reuse, in version 0.19 in November 2019. The release notes gave the reason.

this can eliminate a serious privacy issue where a malicious user can track spends by sending small payments to a previously-paid address that would then be included with unrelated inputs in future payments.

With this option on, the wallet by default excludes coins sent to an address that has already been used from coin selection.

The tiny amounts used for address poisoning have the same property. Spending a 330-satoshi P2WPKH coin takes a bit over 68 vB for the input. At just 5 satoshis per vB the cost to spend it is 340 satoshis, more than the coin is worth. It is money you cannot use once received, and spending it carelessly only reveals the links between your coins.

What You Can Do in Your Wallet

First, do not copy addresses from your transaction history. Get a fresh one from the recipient each time, or label an address the first time you verify it and take it from your address book. The same goes for moving coins between your own wallets: generate a new address in the receiving wallet and a poisoned history has nowhere to slip in. Following the principle of using an address only once removes the "usual address" an attacker would aim at in the first place.

Second, check the whole address, not a few characters at each end. As counted above, matching a few characters at each end is a cost an attacker can bear. If you use a hardware wallet, compare the full address shown on the device screen against the recipient's. A computer screen can be fooled by malware that swaps the clipboard, but the device screen shows the transaction the device itself will sign.

Third, freeze small amounts you never asked for. Wallets with coin control let you mark specific coins as unspendable. Sparrow does this with Freeze UTXO in the UTXO list, Electrum with freeze in the Coins tab. Bitcoin Core locks coins with the lockunspent command, but by default the lock is released on restart, so set persistent to keep it. If you are creating a new wallet, turning on avoid_reuse is another option.

Finally, if you made a test payment, do not take the address for the real payment from your history. Get it again from wherever you got it the first time. The gap between the test payment and the real one is exactly what the attacker is aiming at.

Summary

Address poisoning breaks no cryptography. It steals no keys. It exploits how people handle long strings: checking the ends and trusting the rest. On Bitcoin, leaving even one record costs real coins and fees, so the attack is rare and expensive, but as the 0.1 BTC case shows, it is not absent. A history is not a record of what you did. It is a record anyone can write into. The address you send to should come from the recipient, not from your history.