Web Desk
Cybersecurity experts have uncovered a new kind of bitcoin scam that doesn’t require any direct communication with the victim.
Known as the “Bitcoin Address Poisoning Attack,” the tactic quietly targets bitcoin users who frequently reuse wallet addresses.
Jameson Lopp, speaking at the MIT Bitcoin Club Expo, outlined how the scam works and how it’s catching even experienced crypto users off guard.
How the Address Poisoning Attack Works
The scam begins by identifying a bitcoin user — often someone who dollar-cost averages (DCA) — and regularly sends BTC to the same wallet address.
An attacker then uses a vanity address generator to create a fake wallet address that closely mimics the user’s real one.
These spoof addresses match both the beginning and end characters of the legitimate wallet address.
Next, the attacker sends a tiny amount of BTC (called “dust”) from this fake address to the user’s wallet.
This dust transaction shows up in the user’s transaction history.
When the user later copies their wallet address — thinking it’s their usual one — they may accidentally copy the spoofed address from the history list.
If they send BTC to it, the money goes straight to the attacker.
Why It Works
The trick is simple but clever: most people only glance at the first and last few characters of a wallet address to confirm it.
Since the spoofed address matches these parts, it looks legitimate at first glance.
According to Mononaut, who originally flagged the attack, the cost per attack is low — about 60 cents for each dusting transaction.
But that small cost can lead to large rewards if even one user mistakenly sends thousands in BTC.
How to Stay Safe
To avoid falling for this scam, experts recommend the following:
1. Never reuse wallet addresses. Always generate a new address for each transaction.
2. Verify every character. Don’t rely on just the beginning and end of an address — confirm the full string.
3. Don’t copy addresses from transaction history. Manually retrieve the correct address from your wallet every time.
As Lopp put it, “This attack doesn’t require communication. It just takes one slip-up.”
The Bigger Picture
Vanity address tools can mass-generate spoof wallets cheaply, and scammers are now targeting thousands of users who consistently reuse wallet addresses.
This form of cyber theft highlights the risks even in decentralized systems.
Users are urged to remain cautious and double-check every transaction.
