Guides / Glossary / Address poisoning
Glossary

Address poisoning: the look-alike address scam

A scam that plants a look-alike address in a wallet's history, hoping the victim copies it for their next payment.

Education only

Definition. A scam that plants a look-alike address in a wallet's history, matching the start and end of an address the victim uses, hoping it is copied for the next payment.

How it works

Bitcoin addresses are long strings that most people check by glancing at the first and last few characters. Address poisoning exploits that habit. The attacker generates an address that starts and ends with the same characters as one the victim uses, then sends a tiny payment from it or to it, so it appears in the wallet's transaction history. The hope is that the victim later copies the wrong address from history when making a real payment. The FBI has warned about this pattern.

A related attack uses malware that watches the clipboard and swaps a copied address for the attacker's. Microsoft has described clipper malware that does this.

Why it matters for a company

Companies make repeat payments to the same suppliers, staff or exchanges, which is exactly the pattern these scams target. Bitcoin payments are not reversible, and there is no bank fraud team to call. The losses can be large and quick, and they look like ordinary authorised payments.

The defences are procedural. Never copy an address from transaction history. Keep a verified address book, where each address was confirmed through a second channel, for example a call to a known number. Check the whole address on the signing device screen, not only the ends, and compare it with the verified record. For a new payee, send a small test amount and have them confirm receipt before sending the rest. The UK National Cyber Security Centre's guidance on business payment fraud and the FBI's guidance on business email compromise apply the same thinking to bank payments.

Example only, fictional. A finance assistant sees a supplier's address in history with the right first and last six characters. The policy says history is never a source. The assistant uses the address book entry instead, and the signers notice that the history entry differs in the middle characters.

Common mistakes

Sources

Primary sources only. Each link was checked on 9 November 2026. Rules change, so confirm the current version with your adviser.

  1. FBI DenverFBI warns of cryptocurrency token impersonation scam (look-alike addresses in transaction history)
  2. Microsoft Security BlogCrypto Clipper uses Tor and worm-like propagation, 17 June 2026 (clipboard address replacement)
  3. NCSCBusiness payment fraud: respond and recover
  4. FBI IC3PSA240911: Business email compromise, the $55 billion scam (11 September 2024)
Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.