Address Poisoning: Why Scammers Keep Sending Me $0.00

I made one routine USDC transfer on Ethereum at 5:01 PM on July 31. The first deposit I never asked for — 0.000124 USDC — arrived exactly one minute later. More followed that evening and through the night. By the next morning, the same two tiny amounts were still alternating: 0.000124 USDC at 4:11 AM, 0.000012 USDC at 4:24 AM, then again at 5:36, 6:26, 6:29, and 6:57 — each worth exactly $0.00 after rounding.

Free money, technically. Also the setup for one of the more elegant scams running on public blockchains right now. It’s called address poisoning, and the interesting part isn’t the dust — it’s the addresses it comes from.

Look closer at the senders

Because this was USDC on Ethereum, every account involved appears as a 42-character 0x... Ethereum address. My real transfer went to an address beginning with 0x6e45 and ending with 51d5. Soon afterward, the dust began arriving from two addresses, alternating:

0x6e45B0…458951d5
0x6e45EA…19B951D5

(I’ve truncated the middles on purpose — anyone with the full addresses could trace their dust transfers on-chain and enumerate every victim’s wallet, including mine. There’s some irony in redacting a scammer’s address for privacy, but public blockchains cut both ways.)

These addresses are different from the real one and from each other, but both preserve the same visible anchors: 0x6e45 at the start and 51d5 at the end. That’s not a coincidence. The scammers generated fresh addresses specifically crafted to match my real destination at both ends.

Why both ends? Because that’s all many wallet interfaces show you. Nobody reads the full hexadecimal string; wallets, explorers, and exchanges often truncate Ethereum addresses to something like 0x6e45...51d5. In those views, the scammer’s address and the legitimate one can look pixel-for-pixel identical. The 32 hexadecimal characters in the middle — the only part that differs — are exactly the part the interface hides.

The trap they’re setting

The scam has no step where they take anything from you. Receiving dust is harmless; they can’t touch your funds, and you don’t need to do anything about the deposits themselves. The attack is aimed at a future mistake:

1. You made a real transfer to a real address.
2. The bot immediately sends dust so its lookalike address appears right next to the real one in your transaction history.
3. Weeks later, you need to send to that address again. You do what almost everyone does — open your history, find the last transaction, copy the address.
4. You copy the poisoned entry instead. It looks right: same start, same end, and your eyes check nothing else. The funds go to the scammer, and on a blockchain there is no undo.

That’s the whole scheme. It’s a phishing attack against your copy-paste habit, seeded in advance and left waiting. The alternating amounts in my history are two competing bots, each hoping to be the entry I eventually mis-copy.

Why it costs them nothing

Generating an address with a chosen prefix and suffix is brute force: create a key pair, check the address, repeat. Matching my 4 leading and 4 trailing hex characters means 8 constrained characters, or one hit per 16⁸ ≈ 4.3 billion attempts. That sounds like a lot, but depending on the hardware, a GPU running a vanity-address grinder can search that space in seconds or minutes. The dust transfers themselves cost fractions of a cent in gas. For less than the price of a coffee, a bot can poison thousands of wallets and wait — and since the victims self-select by making transfers, targeting is automatic.

You can watch the search happen in Vanity-ETH. Start with 6e as the prefix and d5 as the suffix for a quick result, then try the full 6e45 and 51d5 pattern from this attack and watch the difficulty jump. The tool runs the same basic loop in your browser, generating random Ethereum key pairs until an address matches, while showing the live speed and probability. Treat it as a demonstration, not a production wallet generator: the matching private key controls the address, so never send real funds to a key produced by a website unless you have audited the code and run it offline.

There are nastier variants, too. The zero-value transfer trick abuses the fact that ERC-20 tokens allow transferFrom of 0 tokens from anyone’s address without approval — so the scammer can make your history show a transfer from you to their lookalike address, which is even more convincing than an incoming deposit. Others send counterfeit tokens with real-sounding names, so the history shows what looks like a legitimate USDT transfer to the fake address.

And it works often enough to be an industry. The most famous case: in May 2024, someone sent 1,155 wrapped BTC — about $68 million at the time — to a poisoned address they’d copied from their own transaction history. (The attacker, remarkably, returned it after the story blew up. Most victims are not that lucky.)

How not to be the story

The defenses are boring, which is the good news:

• Never copy an address from your transaction history. This is the entire attack surface. Copy from the source — the exchange’s deposit page, the recipient’s message, your own records.
• Use your wallet’s address book. Save verified addresses once, under a name, and send to the name. Poisoned entries can’t impersonate a saved contact.
• Check the middle, not just the ends. If you must verify an address visually, compare a chunk from the center — it’s the part vanity generation can’t cheaply fake. Matching both ends and even a short mid-section increases the brute-force cost dramatically.
• Send a test amount first for anything significant — and verify the address for the real transfer from the original source again, not from the test transaction in your history.
• Ignore the dust. Don’t try to send it back, don’t interact with unknown tokens it came with. It can’t hurt you while it just sits there.

Some wallets and explorers have started flagging or hiding suspected poisoning transactions, which helps. But the pattern generalizes beyond crypto: any system that truncates identifiers for display creates a gap between what you verify and what you approve, and someone will eventually build a bot to live in that gap.

Meanwhile, my two bots are still at it, repeatedly and faithfully depositing $0.00. It might be the most patient scam I’ve ever watched — and as long as I never copy from history, all they’re doing is buying me dust.