Security, Address poisoning

Address poisoning and company payouts

By the Payclose team. Updated 14 October 2026

Address poisoning doesn’t break into anything. An attacker makes an address that looks like one your company pays every month, slips it into your wallet’s history, and waits for someone to copy it. Stablecoin transfers can’t be reversed, so one pasted address loses the whole payment.

How the attack works

USDC and USDT transfers are public: anyone can see which addresses your company’s wallet pays, and when.

A look-alike address. The attacker generates addresses until one starts and ends with the same characters as an address you pay. Only the middle is different.
Planted in your history. Then they make it show up in your wallet’s history: a tiny transfer of the same token from the look-alike, a zero-value transfer that shows your own wallet “sending” nothing to it, or a transfer of a counterfeit token that shows your usual amount going to it. The zero-value kind goes through the token’s public transferFrom function and needs no access to your wallet (USENIX Security 2025, MetaMask).
Shortened on screen. Wallets and block explorers often show only the first and last few characters, so in a list of transactions the look-alike reads just like the real address.
One copy. The next time someone pays from history or from an explorer instead of a saved list, the money goes to the attacker.

The address you pay: 0x4be0d1a793c5e240f18b6c3da0579e21b4c607fd
The look-alike: 0x4be0a28c1f7736d9e04c5b12c8d3f6a9e1c207fd
Both, as a wallet’s history shows them: 0x4be0…07fd

Sample addresses. The first and last four characters match; everything between them is different.

It runs at scale. A 2025 study of two years on Ethereum and BNB Smart Chain counted 270 million poisoning attempts against 17 million victims, and 6,633 incidents that cost at least $83.8 million. Organizations fall for it too: the US Drug Enforcement Administration lost about $55,000 in USDT in 2023, and in April 2026 Webacy reported $24,965 in USDC lost on Base to an address with the same first four and last four characters as the intended one.

Why monthly payouts are exposed

The same addresses, every month. A payout pays the same people from the same wallet around the same date, so an attacker knows whom to imitate and when to plant the look-alike.
Copying is part of the job. Whoever runs the payout copies addresses: from last month’s transaction, from the Safe’s history, from a block explorer, from a chat message. Each one is a place where a look-alike can be waiting.
A test transfer doesn’t settle it. It shows that an address can receive funds, not whose it is. In the DEA case, the test itself showed the attacker which address to imitate: a look-alike sharing its first five and last four characters was planted with an airdropped token before the real payment went out.
Many lines, one signature. A batch of twenty transfers is signed in one go. One swapped address among them is easy to miss when every line looks right at a glance.
Address changes arrive in chat. “Here’s my new wallet” is a routine message, and it’s exactly what an impersonator would send. Rules against poisoning have to cover changes too.

What wallets already catch

Wallets and explorers flag some of this now. MetaMask warns when a recipient closely resembles an address from your history. Etherscan mutes zero-value transfers and marks them with a warning icon. Safe{Wallet} marks transactions that look like imitations and warns you when you copy one. Hardware wallets such as Trezor ask you to check every character on the device before you confirm.

These warnings help, but each works in one app, one transfer at a time, and only if the person sending reads it. A monthly payout needs rules that hold whoever runs it that month.

Five rules for a payout team

For any team that pays contractors in stablecoins, whatever tool it uses. Beside each rule, how Payclose applies it.

Pay only from a saved list of recipients.

Keep each contractor’s approved address in one place and build every payout from it. An address that isn’t on the list isn’t paid until it has been through the rules below.

In Payclose: Recipients and their approved addresses are the list. A payout line pays the recipient’s approved address on that network; an address that isn’t on file, even one in an imported CSV, is proposed like any new address.
Never copy an address from history or an explorer.

Not from last month’s transaction, not from the Safe’s queue or history, not from a block explorer, not from a wallet’s list of recent recipients. Take it from the list, or ask the recipient.

In Payclose: A line takes its address from the recipient, never from a past transaction: a payout copied from last month uses each recipient’s approved address as it is today.
Confirm new and changed addresses with the recipient, through another channel.

Not in the thread where the address arrived. Better still, have the recipient sign a message with that wallet: it proves they control the address, and it costs nothing.

In Payclose: In the recipient portal, the recipient confirms an address with a signature from that wallet, and a change is signed by the new wallet and the current one. Owners can require that confirmation before any new address is approved.

The recipient portal
A second person approves every address change, and new addresses wait a day.

Whoever adds an address doesn’t approve it. A day’s pause leaves time to catch a change that shouldn’t have happened before any money goes to it.

In Payclose: An owner or approver who didn’t propose the address approves it, with the new address under the old one and the differing groups of characters marked. It can’t be paid until 24 hours after approval.

Approving a new address
Check every address for look-alikes before you send, in full.

Compare each address in the batch with the addresses you’ve paid before: the same start and end with a different middle is a red flag. Then read the whole address in the wallet, not just its ends, before you sign.

In Payclose: Every new address is compared with every address on file and in your past payouts. The same first four and last four characters with a different middle is flagged, and so is a checksum error.

The address checks

Who approves what, and why the person who sends a payout can’t approve it: the payout approval workflow. Paying from a Safe, where one batch carries every line: Safe multisig payouts.

Check this month’s addresses

Paste this month’s payout addresses, and the ones you’ve paid before, into the free address checker. It flags look-alikes, checksum errors and addresses on the wrong network, and it runs in your browser: nothing is uploaded.

Check payout addresses Get started

In Payclose, every payout is built from the approved list; new addresses are checked, approved by someone else and paused for a day; and you can require the recipient’s own confirmation. Payclose never holds funds or keys: your company pays from its own Safe or wallet. Free during the beta. EVM networks, from a Safe or a regular wallet; TRON later.

Sources

Blockchain Address Poisoning, Tsuchiya, Dong, Soska and Christin, USENIX Security 2025. Used for: scale on Ethereum and BNB Smart Chain; tiny, zero-value and counterfeit-token transfers; shortened addresses in wallets and explorers.
Address poisoning scams, MetaMask Help Center. Used for: vanity look-alike addresses, zero-token transfers, copying from history; MetaMask’s warning.
Zero-Value Token Transfer Attack, Etherscan Information Center, February 2023. Used for: same first and last characters; zero-value transfers muted and marked.
What is address poisoning and how does Safe{Wallet} battle it, Safe Help Center. Used for: imitation transactions flagged, a warning on copying.
What are address poisoning attacks and how to avoid them, Trezor. Used for: don’t copy from history; check every character before you confirm.
DEA gets duped: Agency loses $55K in address poisoning scam, Cointelegraph, August 2023. Used for: a test transfer, a look-alike planted with an airdropped token, about $55,000 in USDT lost.
$25K USDC Address Poisoning Attack on Base, One of Thousands Today, Webacy, April 2026. Used for: $24,965 in USDC lost on Base to a look-alike with the same ends.