Poisonous “Dust”: How Millions Are Stolen Through Carelessness

You open MetaMask, Rabby, or Etherscan and notice unusual activity: microscopic amounts of USDT, USDC, or ETH are being sent to your wallet. Sometimes it’s $0.01, sometimes $0.0001, and sometimes even 0 USDT. At the same time, the senders’ addresses look suspiciously similar to those you’ve already transacted with.

In some cases, you might even see outgoing transactions that you never authorized.

Your first thought might be that your wallet has been hacked. But often the reason is entirely different: Address Poisoning.

This is a fraudulent scheme in which attackers plant fake addresses in your transaction history, hoping that you’ll eventually copy the wrong address and send them money yourself.

By 2026, such attacks had become widespread and automated. There have been reported cases of tens of millions of dollars lost due to a single mistake when copying an address.

What is Address Poisoning?

Address Poisoning is an attack on a user’s trust in a crypto wallet’s transaction history.

Imagine that you regularly transfer USDT between your own two wallets or to an exchange’s deposit address.

You’ve already memorized that the correct address starts with 0x6d90 and ends with 2e48. When you need to repeat the transfer, you’ll open your transaction history, find the familiar address, and copy it.

This is exactly what the scammer is counting on.

They create their own cryptocurrency address whose first and last characters match those of your real recipient’s address. Then they send you a negligible amount of cryptocurrency or create a zero-value or fake token transfer.

Now the fraudulent address appears among your transactions.

The main danger: the money doesn’t disappear the moment the microtransaction is received. The theft occurs later, when the user sends funds to the fake address themselves.

What a compromised address looks like: a real-life example from 2026

On January 30, 2026, an attack occurred on the Ethereum network, resulting in a user sending 4,556 ETH to an attacker. The analytics firm Bitquery estimated the transfer’s value at approximately $12.4 million based on the ETH price on the date of the incident.

Researchers identified the following addresses:

The recipient’s actual address:
0x6d90cc8ce83b6d0acf634ed45d4bcc37eddd2e48

The attacker’s address:
0x6d9052b2df589de00324127fe2707eb34e592e48

Both addresses begin with 0x6d90 and end with 2e48.

Let’s see what they look like in the wallet interface, which truncates the middle part of the address:

In this truncated format, the addresses look identical. Their middle parts are completely different, but the user might not notice this.

Before the theft, the attacker repeatedly sent microscopic amounts of ETH to the victim’s wallet. The first such transfer was recorded as early as October 3, 2025. A few months later, the victim transferred 4,556 ETH to the fake address.

Why do scammers specifically target the last 4–5 letters and numbers?

To understand how this works, it’s important to know how Ethereum addresses and those of other EVM networks are structured.

An Ethereum address consists of 40 hexadecimal characters following 0x. The characters used are digits from 0 to 9 and letters from a to f.

Each character has a total of 16 possible values.

An attacker cannot arbitrarily change several characters in their address while retaining the corresponding private key. Instead, they generate new private keys and addresses en masse until they find a suitable combination.

Such addresses are called vanity addresses—addresses with a pre-selected pattern of characters.

The difficulty of finding a match increases exponentially: each additional matching hexadecimal character increases the average number of attempts by a factor of 16.

These values represent the mathematical expectations for uniformly distributed addresses when comparing without regard to case. The actual lookup time depends on the hardware and the generator’s implementation.

It is important to distinguish between two situations here.

A match involving only the last 4–5 characters requires a relatively small number of computations. Finding such addresses is fairly simple.

A match involving both the first and last 4–5 characters is significantly more complex: we’re now talking about billions or trillions of candidates. However, with the use of optimized software, GPUs, and parallel computing, such tasks remain technically feasible.

Scammers don’t need a perfect duplicate. It’s enough for them that the specific parts of the address—the ones displayed by the wallet or checked by the user—match.

That’s why 4–5 characters from each end is a common compromise between computational cost and visual similarity.

It is precisely the interfaces that hide the middle of the address behind an ellipsis that make such attacks effective.

However, generating a duplicate address does not constitute a breach of Ethereum’s cryptography. The private key of the real address remains unknown to the attacker.

Why send $0.0001, 0 USDT, and other micro-amounts?

The purpose of a micro-transfer is not to transfer value, but to place the desired address in the transaction history.

Technically, scammers use several methods.

1. Dust transfers

The attacker actually sends a tiny amount of ETH, USDT, or another token to the wallet from a similar address.

As a result, the address appears as the sender of the incoming transaction.

The value of the assets sent may be negligible compared to the potential profit. However, the scammer still pays the necessary network fees.

It’s important not to confuse the units: 0.01 cents is $0.0001, while $0.01 is one cent. The interface may display a rounded amount, so the actual transfer amount could be even smaller.

2. Zero-value transfers

In some ERC-20 contracts, it is possible to initiate calls transferFrom for a zero amount without explicit authorization to spend tokens.

This allows an event to be triggered Transfer with an amount of 0, which may appear to be a transaction from the victim’s wallet.

Such a transfer does not in itself mean that the attacker has gained access to the private key or the ability to dispose of the assets.

3. Event spoofing

Fraudsters deploy their own token contracts and generate events Transferthat mimic real transactions.

For example, a fake token with the symbol USDT. Its contract notifies the blockchain of a transfer that appears similar to a transaction involving real Tether.

Some interfaces may display this among the user’s transactions if they do not distinguish carefully enough between genuine and fake token contracts.

As a result, a user might see a supposedly outgoing transfer that they never signed.

This is precisely why it is essential to verify not only the token’s name but also its contract address and the transaction initiator.

For more details: Etherscan’s official guide on Address Poisoning.

How widespread had these attacks become by 2026?

Address Poisoning has long ceased to be a rare, manual scheme.

In the study “Blockchain Address Poisoning,” published at the USENIX Security 2025 conference, researchers from Carnegie Mellon University and their co-authors analyzed the Ethereum and BNB Smart Chain networks from July 1, 2022, to June 30, 2024.

The researchers found:

• Approximately 270 million address poisoning attempts.
• More than 17 million addresses that were targeted by attacks.
• 6,633 detected cases of successful fund redirection.
• Transfers by victims totaling at least $83.8 million.

This final amount cannot automatically be considered the total irrecoverable loss: some of the transfers in certain known incidents were returned.

Source: USENIX Security 2025 — Blockchain Address Poisoning.

In March 2026, Etherscan published additional data on increased activity.

Within 90 days following the Ethereum Fusaka upgrade on December 3, 2025, the number of USDT transfers worth less than $0.01 rose from 4.2 million to 29.9 million compared to the previous 90 days.

This represents a 612% increase.

This does not mean that all 29.9 million transactions were fraudulent: Etherscan explicitly notes that not every dust transaction constitutes an attack. However, large-scale address poisoning campaigns contribute to this activity.

Additionally, MetaMask reported in June 2026 that its partner Blockaid had flagged 65.4 million transactions as address poisoning between January 2025 and February 2026.

This figure represents the number of detections by the system, not the number of successful thefts.

Real-Life Cases: How Users Lost Millions of Dollars

May 2024 — approximately $68–71 million in WBTC

On May 3, 2024, an Ethereum user sent 1,155 WBTC to an attacker’s address that mimicked a previously used address.

At the time of the initial transaction, the value of the assets was estimated at approximately $68 million. Other reports cite a figure of about $71 million due to a change in the valuation of the assets.

Chainalysis reconstructed the sequence of transactions and confirmed the address poisoning mechanism.

Following public negotiations, the attacker returned the bulk of the funds to the victim.

An important detail: although the large transfer was recovered, Chainalysis estimated the attacker’s profit from the broader campaign at approximately $1.49 million, even after accounting for the funds returned to the primary victim.

Source: Chainalysis — Anatomy of an Address Poisoning Scam.

December 2025 — Nearly $50 million in USDT

On December 20, 2025, one of the most telling incidents occurred.

A user planned to transfer a large amount of USDT between their wallets.

First, they made a test transfer of 50 USDT to the real address. Then, the attacker’s automated system generated a duplicate address that matched the recipient’s address in the first five and last four characters.

The fake address was introduced into the transaction history through small transfers.

About 26 minutes after the test, the user sent 49,999,950 USDT to the fraudulent address.

According to The Block and SlowMist, the attacker quickly exchanged the USDT for DAI, then for ETH. A significant portion of the assets was transferred via Tornado Cash.

The victim offered a $1 million reward for the return of the principal amount. A verified report confirmed the reward offer, but no funds have been returned in this case.

This incident highlights another issue: a test transfer protects against certain errors, but does not guarantee security if, after the test, the user copies the address again from a history that has already been compromised.

Source: The Block, December 20, 2025.

January 2026 — 4,556 ETH, approximately $12.4 million

On January 30, 2026, an attack occurred on a wallet that had previously sent ETH multiple times to the same counterparty.

The fraudulent address matched the genuine one in the first four and last four characters.

The attacker began sending dust transfers as early as October 2025. After another such transfer in January 2026, the user sent 4,556 ETH to the fake recipient.

About 33 minutes later, the funds were withdrawn to another address.

Bitquery published the addresses of the parties involved and the hashes of the corresponding transactions, allowing for an independent investigation of the transaction chain.

Source: Bitquery, August 2026 analysis.

August 2026—approximately $39,890 following a fake test transfer

The analysis published by Bitquery also includes an incident from August 9, 2026.

A user sent a test transfer of 115.147641 USDT.

Twelve seconds later, the fraudulent contract created a fake event mimicking a transfer to a duplicate address.

About 13 minutes later, the user sent approximately 39,890 USDT to the incorrect address.

This case is particularly illustrative: the attack can replicate not only the appearance of the address but also the amount of the transaction that just took place.

Source: Bitquery — Address Poisoning on Ethereum .

What security measures are available in 2026?

In recent years, protective mechanisms have emerged not only in blockchain analytics tools but also directly within user wallets.

1. Etherscan Public Labels — Poisoning Address

Etherscan marks some of the identified fraudulent addresses with special public labels.

The following labels may appear on the page of a suspicious wallet:

• Poisoning Address
• Fake_Phishing...
• Phish / Hack

For some addresses, Etherscan also displays a warning about involvement in address poisoning attacks.

For example, this address on Etherscan was flagged as being used by a malicious actor for address poisoning.

These public labels appear without the need to manually create a custom label. Etherscan confirms that it actively flags fraudulent addresses and counterfeit tokens.

However, the absence of a label does not prove safety. New addresses may appear before the system has time to recognize them. Public warnings are an additional indicator, not a guarantee of protection.

2. Hiding Zero-Value Transfers and Suspicious Tokens on Etherscan

Etherscan hides zero-value token transfers by default and uses filtering mechanisms for transactions involving tokens with low reputation.

Users can also apply a Token Ignore List.

As a result, some fraudulent transactions no longer clutter the interface.

This reduces the likelihood of accidentally copying an address, but does not delete the records from the blockchain.

3. Address Highlight and Etherscan Custom Labels

The Address Highlight feature allows you to visually highlight identical addresses in the browser interface.

You can enable it via Site Settingsif it is disabled.

In addition, Etherscan supports Private Name Tags—custom labels for addresses.

For example, you can label a verified recipient as “My USDT Wallet” or “Exchange — Deposit Address.”

These tags are available in your logged-in Etherscan account and help distinguish familiar addresses from random duplicates.

Important: A custom tag does not replace the initial address verification. It should only be assigned after confirming the correct recipient.

4. Automatic Detection of Address Poisoning in MetaMask

On June 17, 2026, MetaMask announced the implementation of Address Poisoning Detection.

The mechanism compares the address that the user pastes before sending with addresses used previously.

If the address looks familiar—for example, if the first and last characters match but the middle part is different—the wallet displays a warning before executing the transaction.

A separate warning is also displayed when sending to an address that has not been used before.

According to MetaMask, at launch, the feature became available in the mobile app and browser extension for EVM networks.

The new warnings do not make erroneous transfers technically impossible: users still have the option to confirm the transaction themselves.

Official source: MetaMask — Address Poisoning Detection, June 2026.

5. Address Book and Trusted Recipient Lists

The most reliable organizational method for regular transfers is to save verified addresses in advance.

For example, in MetaMask, you can use the Contacts. Other wallets and services also offer similar address book or trusted recipient features.

The principle is simple: the recipient’s address is added once after verification from a reliable source, and subsequent transfers are made specifically to the saved address, rather than to an address from the incoming transaction history.

For corporate transactions, additional measures are useful: approved addresses, separate confirmation of new recipients, and multi-party authorization for large payments.

6. Full address verification, including on a hardware wallet

A hardware wallet protects the private key but does not, by itself, guarantee protection against address poisoning.

If a user confirms a transfer to the wrong address, the hardware device will faithfully sign that specific transaction.

Therefore, before confirming, it is necessary to verify the recipient’s address against an independent, trusted source, including its middle portion.

For large amounts, it is especially important to ensure that the address is verified by both the sending interface and the signing device.

What should you do if strange transactions have already arrived in your wallet?

Simply receiving a suspicious transaction is not yet proof of a hack.

If you notice a suspicious transaction:

1. Do not copy the sender’s address. Even if it matches a previously used address by a few characters.
2. Check the transaction in a blockchain explorer. Pay attention to the token contract, the amount, the actual initiator of the transaction, and any risk flags.
3. Do not interact with unknown tokens. Do not visit the websites they advertise, and do not sign any proposed transactions.
4. Use wallet filters and Etherscan. Suspicious tokens and zero-value transfers can be hidden from the interface.
5. Only use a verified address before sending funds. Do not rely on recent entries in the transaction history or abbreviated addresses.
6. If funds have already been sent to a scammer, save the transaction hash and addresses. Immediately contact the service you’re using, the token issuer (if such a procedure exists), and law enforcement. A refund is not guaranteed.

However, you do not need to automatically change your seed phrase, transfer all assets to a new wallet, or revoke all permissions just because of an incoming microtransaction.

However, if verification reveals genuine unauthorized outgoing transactions, this is a separate indication of a possible compromise and requires an immediate security assessment of the wallet.

Is it possible to completely prevent such attacks?

It is usually impossible to completely prevent third parties from sending transactions to a public blockchain address.

Any network participant can send you assets. In some cases, they can also create a token event that affects how your address is displayed in the explorer.

Therefore, the primary goal of security systems is not necessarily to prevent spam transactions from appearing on the blockchain, but to prevent them from being used as a source of trusted addresses.

By 2026, the most practical protection will be based on several layers: filtering suspicious transactions, flagging fraudulent addresses, detecting duplicates at the time of sending, and using pre-verified address books.

Conclusion

Strange transfers of $0.01, $0.0001, or 0 USDT may be part of a large-scale address poisoning attack.

Fraudsters do not necessarily need to hack a wallet, obtain a private key, or exploit a smart contract vulnerability.

In some cases, it’s enough to generate a similar address, send a minimal amount, and wait for the user to copy it from their transaction history.

A match of the last four or five characters is not proof of an address’s authenticity. Even a match of several characters at both ends could be the result of a targeted attack.

The golden rule of security in 2026: the transaction history is an event log, not a trusted address book.

Verify the recipient’s full address, use MetaMask’s security warnings and Etherscan labels, and for recurring transfers, store addresses in a pre-verified contact list.

A single unnoticed difference in the middle of an address can cost you significantly more than all the microtransactions scammers use to fill your wallet.