USDT address poisoning: the lookalike address scam

How it works

On Ethereum, token contracts allow transfers of zero tokens that anyone can trigger, which lets scammers put entries in your history at little cost. On TRON, tiny transfers and copy tokens do the same job.

How costly it can be

In a widely reported case in May 2024, a crypto holder sent about $68 million in wrapped bitcoin to a poisoned lookalike address. Most of it was later returned after negotiations, which is rare. Most victims lose smaller sums and get nothing back.

How to avoid it

1. Never copy a recipient address from your transaction history.
2. Save trusted addresses in your wallet’s address book and send from there.
3. Compare the whole address, or at least the start, the middle and the end.
4. Send a small test, then confirm with the recipient before the full amount.
5. Hide or ignore zero-value and unknown token transfers.

The checker above flags addresses that share the first or last characters with an official USDT contract, the same trick used for copy tokens.

Related

Unknown USDT tokens in your wallet, USDT ERC20, USDT TRC20.

What a poisoned history looks like

How lookalike addresses are made

Address generators can produce addresses with chosen characters at the start and the end by trying millions of keys. Matching four or five characters at each end is cheap with modern hardware. Wallets often shorten addresses to exactly those characters in lists, which is what the attack relies on.

Why it happens right after you pay

Attackers watch the chain for transfers of USDT, then send poison to the sender almost immediately. The poison sits at the top of your history next to the real payment. The next time you pay the same person, the lookalike is the first thing you see when you scroll to copy the address.

Defences that work

How to confirm a USDT address poisoning attempt

An unexpected zero value transfer or unknown token entry does not always mean someone is trying to poison your address. Airdrops, dust from marketing campaigns, and failed transactions can also appear in your history. Address poisoning is more specific: the sender address shares the start and end with a recipient you recently paid, and the entry shows up right after your real payment.

To confirm, compare the full sender address from the suspicious entry with the address you actually sent to. If the first and last few characters match but the middle does not, you are looking at an address poisoning attempt. Do not interact with the entry or copy anything from it.

Step-by-step confirmation

1. Open your wallet history and find the real USDT payment you made.
2. Write down or copy the full recipient address from your own records, not from the history.
3. Find the suspicious incoming entry, often 0 USDT or a copy token.
4. Compare the full sender address of that entry with your real recipient address.
5. If they match only at the ends and differ in the middle, it is an address poisoning attempt.
6. Hide or ignore the entry. Do not send anything to it.

You can also use a block explorer to see the transaction details. The entry may use a token that copies the name “Tether USD” or “USDT” but has a different contract address. Paste the token contract address into the USDT contract checker or compare it with the official addresses listed there. A zero value transfer of the real USDT contract can also be poison, so the token contract alone does not clear the entry.

What to do if you already sent USDT to a poisoned address

Once a transfer is confirmed, it cannot be reversed by your wallet or by Tether. Anyone who promises to reverse it for a fee is running a recovery scam. Your first steps should be to collect evidence and report, not to pay for help.

1. Stop sending more funds to that address or any address the scammer suggests.
2. Save the transaction hash and the full wrong address.
3. Note the exact time, amount, and network: TRON, Ethereum, or BNB Chain.
4. If you sent from a custodial exchange, open a support ticket immediately and explain the address poisoning.
5. If you have details of the scammer or a platform, report it through the report page or your local cybercrime unit.
6. Ignore anyone who contacts you claiming they can recover the funds for a fee.

In rare cases, the owner of the lookalike address may return funds, but you should not expect it. If the amount is large, you may want to consult a lawyer in your country. Do not rely on online recovery services. See crypto recovery scams for the common patterns.

Zero value transfers: why they exist and what they mean

A zero value transfer is a token transaction where the amount is 0. On Ethereum and BNB Chain, the token standard allows anyone to trigger a transfer of zero tokens from any address to any address. The transfer does not move value, but it does create a log entry in the recipient’s address history. On TRON, a very small amount of TRC20 USDT can be sent instead, or a copy token can be used for the same purpose.

This is why a zero value token transfer can appear in your wallet even if you never gave the sender permission. It is not a sign that your wallet is hacked. It is a sign that someone is using public ledger mechanics to put a lookalike address in front of you.

The scam only works if you later copy that sender address from your history. Hiding or ignoring these entries removes the trap.

What to check before sending USDT: a use case table

Save any address you use more than once in your wallet’s address book. The address book is not foolproof, but it removes the main habit that lets address poisoning work: copying from history.

Common mistakes that let a poisoned address through

The most common mistake is checking only the first and last few characters. Scammers generate lookalikes that match exactly those characters, so a quick glance is not a check. Compare the middle section as well.

Another mistake is treating the address book as automatically safe after one use. If you save a poisoned address by accident, every later payment goes to the wrong place. Verify the entry when you add it and again before any large transfer.

A third mistake is using a search engine or a random website to look up an address before sending. The result may be a lookalike listed by the scammer. Use only the official block explorer for the network: Etherscan for Ethereum USDT, Tronscan for TRON USDT, and BscScan for BNB Chain USDT.

What to do when you receive a zero value transfer or a copy token

Do not interact with the token. Some copy tokens have contracts that can ask for approval or lead you to a phishing site. In most wallets you can hide or ignore the entry so it does not clutter future history.

If the token is not the official USDT contract, you can check it against the three official contracts on the USDT contract address page. If it is not listed there, it is not USDT, even if the name and symbol say USDT.

You can also report the token or the sender address through the block explorer’s abuse reporting, if available. That does not remove the entry but helps other users see the warning.