A familiar address in your history may belong to the wrong recipient

The target is your next transfer

Address poisoning aims to make you copy the wrong address next time. Attackers use tiny or zero-value transfers to insert an address with familiar-looking ends into your history. It resembles a known recipient but belongs to someone else. MetaMask describes this tactic in its security documentation.^[1]

An outgoing zero-value record does not prove you signed

ERC-20 requires zero-value transfers to emit a Transfer event. Ledger explains that some token implementations let a third party trigger a zero-value transferFrom, leaving a record that appears to originate from your address. This does not establish that your private key was obtained or real tokens were taken; contract implementations need to be checked individually.^[2][4]

MyEtherWallet recommends checking real asset balances with a block explorer. Do not connect to an unfamiliar website to remove unwanted tokens or records, and never give your recovery phrase to someone claiming to be support.^[3]

Check the source, then check what you pasted

For transfers to yourself, obtain the address from your wallet's receive screen. For someone else, request the full address through a verified channel. Avoid selecting a familiar-looking entry from history. Save frequent recipients as contacts only after checking their addresses.^[1][2]

Compare the entire pasted address, not just its ends. With a hardware wallet, also check the device screen. BlockBlah's conclusion from these safeguards is that the device provides another place to check; you still need to confirm it is the intended recipient.^[1][2]

If the address changes after pasting, stop the transfer. MetaMask explains that malware can replace clipboard addresses. A successful paste into a text editor does not rule out malware that activates only in a particular wallet field.^[5]

Check actual assets when a record looks suspicious

Examine token records, actual balances and transactions you signed separately. A zero-value record alone proves neither theft nor that the wallet is safe. Based on the documentation above, unexplained outflows of real assets should not be treated as merely address poisoning. Find support through the wallet's official website, rather than replying to unsolicited repair messages.^[3]

Sources and production disclosure

This guide draws on official public documentation accessed on November 5, 2026. No wallet product was tested. AI assisted with research, writing and translation; the cover is AI-generated conceptual artwork. This article is not sponsored. It provides general security information and does not guarantee protection against every attack.