Address poisoning: check an address before sending USDT

Short answer: An address poisoning attack puts a lookalike destination into your transaction history so you might copy it for a later payment. A zero-value or tiny transfer can be bait; it does not by itself show that your wallet was taken over. Check the full address and the network against a source you trust, then save the verified destination in an address book or exchange whitelist. For later sends, choose that saved entry rather than a recent transaction, and confirm a test transfer arrived before sending more. An explorer warning helps you investigate, but it cannot approve an address for you.

What is address poisoning?

Crypto address poisoning is a scam that tries to make a false destination look familiar. Someone adds a similar-looking address to your transaction history, hoping you will copy it instead of the address you meant to use.

The entry may come from a small real transfer, an unfamiliar token, or a zero-value token event. A zero-value transfer records a token amount of zero: no tokens moved, but the event can still appear in a history view.

Etherscan describes zero-value token events involving USDT and other ERC-20 tokens, and warns that spoofed events can make a fake address appear beside a real one (Etherscan Information Center, Address Poisoning Attacks, published 15 January 2024).

That does not mean the attacker can spend from your wallet. The danger is the next send: you choose the planted address. A transfer shown as if it came from your wallet can also be a spoofed token event, so compare it with your wallet’s actual signed activity before concluding that you sent it.

A peer-reviewed study in the Proceedings of the 34th USENIX Security Symposium measured Ethereum and Binance Smart Chain activity from July 2022 to June 2024. The researchers counted more than 270 million poisoning attempts aimed at 17 million victims and 6,633 successful transfers with at least US$83.8 million in losses. Those are the study’s two-chain results for that period, not a current count or a forecast (Tsuchiya et al., Blockchain Address Poisoning, USENIX Security 2025).

Why are the first and last four characters not enough?

Those characters are a quick visual clue, not proof that two addresses match. A lookalike can share the visible beginning and ending while differing in the middle, where a shortened display hides the difference.

The addresses below are fictional examples made for this article; do not use them. They share the first four and last four characters. All 32 characters between them differ.

The shortened view hides a middle difference between two fictional addresses. Source: Etherscan Information Center, Address Poisoning Attacks, checked November 2026.

Etherscan says it displays more of an address’s first and last characters to help distinguish lookalikes, and recommends checking neighbouring entries in the Token Transfers tab.

But a longer preview is still partial: open the full address and compare it with the one you obtained from the recipient or another trusted source (Etherscan Information Center, Address Poisoning Attacks, published 15 January 2024; Zero-Value Token Transfer Attack, published 23 February 2023).

How do you check a suspicious transfer on Etherscan or TronScan?

Use the explorer to inspect what was recorded, then verify the intended destination independently. An explorer can show a suspicious transfer or a risk marker; it cannot prove that another address belongs to your recipient.

1. Choose the matching network. Use Etherscan for Ethereum activity and TronScan for TRON activity. Tether lists USD₮ on both Ethereum and Tron, so a USDT label alone is not enough: the asset and network must both match the transfer you intended (Tether, Supported Protocols and Integration Guidelines, checked 8 November 2026).
2. Open the address or transaction in the explorer. Type etherscan.io for Ethereum or tronscan.org for TRON, then search for the address or transaction hash (the official pages do not describe the current search controls, so yours may look different). On Etherscan, open the Token Transfers tab and inspect the entries around the transfer you recognise. Etherscan says its zero-value token entries are muted and marked with a grey warning icon; its guidance says to compare the addresses above and below the row (Etherscan Information Center, Zero-Value Token Transfer Attack, published 23 February 2023).
3. Compare the suspicious row with your records. Check whether the amount is zero, whether the token and network are the ones you intended, and whether you authorised the send. A token event is not by itself proof that you approved a transaction.
4. Do not copy a recipient from the suspicious history. Get the intended address from the original recipient, invoice or exchange deposit page, then compare every character and confirm the network. If the full address does not match, stop.

We could not open TronScan’s own documentation for this article, so we do not describe a TronScan warning label here; compare the full address there the same way.

Etherscan hides zero-value transfers by default, according to its address-poisoning guidance. So not seeing a zero-value row does not establish that an address is safe; dust transfers and other spoofed token events are different ways of planting a lookalike (Etherscan Information Center, Address Poisoning Attacks, published 15 January 2024).

How do you make your next USDT send safer?

Build a routine that removes transaction history from address selection: verify the destination once, save it under a clear name, and send from that saved entry. A test transfer can check receipt, but it does not make copying the next address from history safe.

For an exchange withdrawal, Binance documents this whitelist route, checked November 2026: open Settings → Withdrawal → Address Management, choose Add → Add address, label it, select the asset and network, tick Add Address to Whitelist, save, and complete 2FA.

With the withdrawal whitelist enabled, withdrawals are limited to saved addresses. Binance also documents a Whitelist Withdrawal Limit that can suspend withdrawals to newly added entries for a selected time (Binance Support, How to Manage Withdrawal Settings for My Binance Account?, updated 22 October 2026).

Use this check before a new destination and repeat it if the recipient changes the address:

1. Get the address and network from a trusted source. Use the recipient’s original message, a known contact method, or the exchange’s own deposit page. Do not take it from a recent transfer, a search ad, or a message that arrived unexpectedly.
2. Compare the whole address. Check the beginning, middle and end against the source you just opened. Confirm the asset and network as separate fields.
3. Save and name the verified address. In an exchange, use its withdrawal address book and whitelist. In a wallet, use its contacts feature if available. A saved label is a reminder, not proof; recheck a changed destination against its source.
4. Send a small test amount when the transfer warrants it. Confirm that the expected recipient received it through a channel you already trust. Do not use the resulting history row to address the main transfer; select the saved entry again.
5. Send the remainder only after receipt is confirmed. If the saved address, network or recipient does not match your record, stop and verify again.

The routine costs time and a test send may incur a network fee. It reduces the chance of selecting a poisoned history entry; it cannot guarantee that the destination is controlled by the person you expect.

What if you already sent crypto to a poisoned address?

Save the transaction details and contact the sending exchange or wallet provider immediately. Nobody can promise a recovery.

Record the transaction hash, full sending and receiving addresses, asset, network, amount, date and time.

If an exchange sent it, report it through the exchange’s official support route; Binance says it cannot locate a receiver or provide further help for a withdrawal to a wrong address, while recommending that users contact the receiving platform when the address belongs to one (Binance Support, What Can I Do If I Withdraw to a Wrong Address?, published 5 January 2018).

If the transfer was USDT, Tether directs theft and scam reports to its Information Requests team. Its recovery policy covers only specific cases it decides are recoverable, and says an attempted recovery is not guaranteed. That is not a general refund route for a poisoned-address payment (Tether, Tether tokens Recovery, checked 8 November 2026).

Report the loss to the relevant law-enforcement authority where you live. For US victims, the FBI asks for transaction details in a report to IC3 (FBI IC3, Guidance for Cryptocurrency Scam Victims, published 24 August 2023).

Ignore unsolicited messages promising recovery for an upfront fee. The FBI warns that crypto recovery scams charge fees and may ask for more money, and says private recovery companies cannot issue seizure orders (FBI IC3, Increase in Companies Falsely Claiming an Ability to Recover Funds, published 11 August 2023).

What can these checks not tell you?

An explorer can help you inspect a record; it cannot certify that an address is safe or reverse a completed transfer. A missing warning is not an approval, and a suspicious zero-value row alone does not show that your keys or funds were taken.

Use the full address from a source you trust, not a label, partial match, transaction history row or explorer risk badge. If the address or network differs from your saved record, do not send.

For more on how crypto transfers and investment risks work, read how withdrawals work and the risks to keep in mind; for other ways crypto scams rely on rushed decisions, see how to verify claims about a crypto pump and dump.

What this means for your money

Treat every new destination as unverified until its full address and network match a trusted source.

Address poisoning does not need access to your wallet if it can persuade you to choose the wrong address. Your strongest habit is to keep recent transaction history out of the send flow.

We run Cointrapper, a private, invite-only algorithmic trading pool on Binance. Participants invest USDT into the pool’s shared accounts and hold units in the pool; they do not hold individual futures positions of their own, and the pool is not a bot running on a participant’s exchange account.

Futures trading and pooled investing are high risk. Your entire investment can be lost, and capital is not insured. Nothing here is individual investment advice, and exchange rules and wallet interfaces change — check the current official documentation for the network and service you use.