Fifteen crypto holders have lost a combined $9.4 million in the past four weeks to a single address poisoning scammer operating on the Tron blockchain, according to on-chain investigator SpecterAnalyst.
How address poisoning targets users
The attacker drained funds from fifteen victims, with the two largest individuals each suffering $2.5 million in losses. The stolen assets were quickly converted to USDD, the Tron-based stablecoin, and transferred into a single consolidation wallet.
Analyst Stacy Muur explained that address poisoning works by having the scammer send minuscule amounts of cryptocurrency—known as dust transactions—from addresses made to resemble legitimate ones the victim has recently interacted with. These fake addresses are crafted to imitate the genuine recipient’s address by matching the first and last few characters.
Since most crypto wallets display only the start and end of each address due to their length, users often recognize only these segments. This pattern makes it easy for a scammer’s dummy address to slip into a user’s transaction history, where it can be mistakenly copied and used later for a large transfer, unknowingly sending funds to the attacker instead of the intended party.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLWhen blockchain addresses display just a few starting and ending characters in a user’s history, individuals may not notice a malicious address in the middle and can mistakenly send funds to a scam operator, especially when reusing addresses from previous transactions.
A striking example occurred on August 22, when Bofur Capital, an investment firm, lost around $2 million. The attacker had earlier sent a dust transaction of just 0.0002 USDC to Bofur from a fraudulent address, then waited until Bofur withdrew funds from Compound. By pasting the wrong address from their transaction list, Bofur inadvertently transferred the funds to the thief, who quickly swapped the USDC for DAI to avoid a freeze.
Current wallet protections and limitations
Some wallet providers have responded by introducing new safety features. MetaMask, owned by Consensys, and Trust Wallet have launched protections to help users avoid address poisoning, but their solutions focus mainly on EVM-compatible blockchains such as Ethereum, BNB Smart Chain, and Polygon. Tron users remain largely unprotected.
MetaMask now issues a warning when users attempt to send assets to an address where only the visible first and last segments match a previously saved address, but the internal characters differ.
Trust Wallet introduced Address Poisoning Protection in March. This function checks addresses against a curated database of flagged poison addresses and presents a side-by-side view if a match is found. Trust Wallet has reported intercepting over 225 million poisoning attempts and confirmed over $500 million in losses to this particular scam method. The company estimates this represents 34,000 attacks per hour.
Cryptopolitan has noted that low gas fees on Ethereum enable scammers to conduct high volumes of dusting attacks, which can artificially increase the platform’s daily transaction counts.
After a $50 million address poisoning heist in December, Binance founder Changpeng Zhao urged all crypto wallets to check and block suspected poison addresses.
Keeping funds secure amid evolving threats
With varied adoption of anti-poisoning technologies among wallets and inconsistent coverage across blockchains, experts emphasize personal vigilance. Users are advised to verify every character in destination addresses and store trusted contacts using wallet address book features, instead of copying from transaction history.
When sending large sums, it is also prudent to first transfer a small test amount for confirmation. In a market where a single Fed decision or sudden altcoin listing can change everything within seconds, investors moving rapidly between separate apps for news, portfolio management, and price charts may expose themselves to added risk and cost. Many traders are now turning to privacy-first platforms like CryptoAppsy, which offer a unified dashboard featuring real-time charting, coin-specific news, portfolio tracking, smart price alerts, and key macroeconomic indicators—all without requiring the creation of an account.
Until security features become standard on every blockchain and wallet, user awareness and best practices remain the front line of defense against address poisoning and similar attacks.
