Address Poisoning and Signature Phishing: How Not to Lose Your Coins

Short answer: address poisoning plants a lookalike address in your transaction history so you copy the wrong one later; signature phishing tricks you into signing a message that hands over spending rights. Neither breaks cryptography — both break habits. Verify the full address every time and read what you are signing, and both attacks fail.

Why this matters more than exchange hacks

Social engineering and phishing were the single most damaging attack category in the first quarter of 2026, accounting for roughly $290 million in losses — more than every other category combined. Phishing and address poisoning caused about $83.8 million in wallet losses across as many as 17 million affected addresses during 2025, and researchers at Carnegie Mellon counted around 270 million poisoning attempts.

The pattern in 2026 is concentration. In January, signature-phishing losses jumped 207% month over month to roughly $6.3 million, while the number of victims actually fell 11% — two victims accounted for nearly 65% of the total. Attackers stopped spraying and started hunting large balances.

Address poisoning, step by step

The attack is simple and it costs the attacker almost nothing:

1. They watch the chain for your transfers and note the addresses you send to.
2. They generate a vanity address whose first and last characters match the one you use — the middle is different, but nobody reads the middle.
3. They send you a zero-value or dust transaction from that lookalike address, so it lands in your history.
4. Next time you pay that counterparty, you scroll your history, copy what looks like the right address, and send.

The December 2025 case that cost $50 million in USDT is the archetype: the victim copied the spoofed address just 26 minutes after successfully completing a test transaction to the real one. The test transfer did not help, because the address was re-copied from history afterwards.

Signature phishing, step by step

Here you are not tricked into sending funds — you are tricked into authorising someone else to take them. A site asks you to "verify your wallet", "claim an airdrop" or "cancel a pending order", and the popup you approve is actually a token approval, a permit signature or a delegation. Nothing leaves your wallet at that moment, which is exactly why it feels safe. The drain happens later, sometimes days later, and by then the connection to the site is not obvious.

Wallet-drainer kits industrialised this. In early 2026, researchers uncovered a coordinated campaign involving roughly 5,000 malicious addresses tied to drainer tooling.

The defences that actually work

A safe payment routine

1. Store counterparty addresses in your wallet's address book once, verified through a channel you trust.
2. When paying, select from the address book — never from history, never from a chat message.
3. If you must paste, compare four characters at the start, four at the end and four in the middle.
4. On a hardware wallet, confirm the address on the device screen. That screen cannot be rewritten by malware on your computer.
5. For a new counterparty or a large sum, send a test amount, then confirm receipt out of band before sending the rest — and re-select the address from your address book, not from the test transaction.

If you already signed something suspicious

Act immediately, in this order: revoke the approvals for that wallet using a reputable revocation tool; move remaining assets to a fresh wallet with a newly generated seed phrase; assume any token that had an open approval is at risk until the revocation confirms. If the compromise came from a seed phrase entered on a website, the wallet is gone permanently — no revocation helps, because the attacker holds the keys. Move everything, immediately.

Related reading: self-custody without losing your coins and how to vet a crypto exchanger.

FAQ