Address poisoning scam: crypto sent to a lookalike address?
Date: | Week 43 | Reading time: 7 minutesAuthor: Simcha Schrijver
In brief
In an address poisoning scam, someone plants a lookalike wallet address in your transaction history, hoping you will copy it by mistake later on. The address matches one you know at the start and the end. Not every wrong transfer is address poisoning, but it happens more often than many people think.
As an independent expert firm, Paucitas handles hundreds of cases a year. Paucitas works out which address your crypto went to, how that address ended up in your history and where the money went after that.
Unsure about a transfer to an address that is not quite right? Get in touch with Paucitas. A free intake comes with no obligation.
Put simply
An address that looks almost the same as yours may be a fake. Whether it is, and where your crypto is now, can be properly worked out. Ask Paucitas.
You meant to send crypto to your own wallet, to an exchange or to someone you know. You copied the address from your earlier transactions, as you had done before. But the money never arrived. On a closer look, the middle of the address is different. That is a horrible moment. You are not the only one, and it is good that you are taking a calm look at it now.
What is an address poisoning scam and how does it work?
Address poisoning is a type of crypto fraud in which a fraudster creates an address that closely resembles one you have used before. Usually the first and last characters match. From that lookalike address, the fraudster sends a tiny amount, or a zero value transaction, to your wallet. Suddenly the address sits in your history, between your genuine transactions.
If you later copy an address from that history, it is easy to pick the wrong one. It works precisely because it feels so ordinary: you are not doing anything unusual, you are only copying an address. The FCA's advice is to stop and check before you send money or crypto anywhere (FCA, protect yourself from scams).
How can you tell it might be address poisoning?
One sign on its own does not say everything. A wrong transfer can also be a typo, or another address belonging to the same party. If several signs come together, it is sensible to have it looked into. These five are the ones we see most in practice:
- Tiny or empty transactions. Shortly before or after a genuine transfer, transactions of a few pence or of zero appear in your history.
- The start and end match, the middle does not. At first glance the address looks identical, but the characters in the middle differ.
- A sender you do not know. The small transaction comes from an address you have never dealt with yourself.
- Copying from your history. You took the address from your earlier transactions rather than from your address book or from the recipient directly.
- The money does not arrive. The recipient sees nothing come in, even though the transaction went through on the blockchain.
Does this sound familiar? It is not automatically a scam. Sometimes the money turns out to be on an address of your own after all. You get clarity when someone looks at it independently. Paucitas is happy to take a look with you.
Sent crypto to the wrong address: what can Paucitas do?
A transfer on the blockchain cannot be reversed like a bank payment. But the route is visible. Paucitas follows step by step where the crypto went from the lookalike address, for example through other wallets to an exchange. Read also how Paucitas traces stolen crypto to an exchange. Paucitas does all tracing itself, without tracing tools.
Paucitas does more than follow transactions. Paucitas reads through all conversations, documents, emails and other communication you have, such as the invoice or payment request, the messages with the recipient and screenshots of your wallet. That gives a complete picture, with a timeline and, step by step, where all the money went. It also becomes clear when the lookalike address appeared in your history.
Sometimes the address turns out to be yours or the right recipient's after all, and nothing is wrong. Sometimes there are still funds on a wallet you can regain access to. And sometimes the report shows where the crypto ended up. Would you like to know what this means for your situation? Get in touch and we will think it through with you.
An example from practice
A business owner had been paying a supplier in stablecoins for months. One day he copied the address from his own transaction history. The money never arrived. Paucitas read through the invoices, the emails with the supplier and the screenshots of his wallet. It turned out that a day earlier a zero value transaction had come in from an address with the same start and end. Paucitas followed the payment from that address through three wallets to an exchange and put everything in a timeline. With the report he knew exactly what had happened and which steps he could take.
Paucitas values privacy and never shares clients' personal details. This is a composite example: names, amounts and details differ. The situation is, however, as we come across it in practice.
What can you do with the Paucitas report?
The report shows whether money is still available, or where it went, and what the next steps could be. In the case of a scam, that might be a report to the police via Report Fraud or, in Scotland, to Police Scotland, where the Paucitas report is a strong attachment that sets everything out fully and clearly. Your solicitor, your accountant or the exchange where the money arrived can work with it too. The report is written so that anyone can follow and understand it step by step. If you would like to know afterwards whether anything happens with the address, address monitoring can help.
Why do people choose Paucitas?
After a transfer to a lookalike address, trust does not come easily. That is why Paucitas is fully transparent. Paucitas is an expert firm based in the Netherlands, founded in 2021 and registered with the Dutch Chamber of Commerce (KvK) under number 83489649. Our company details are public, you are welcome to visit our office and you can read clients' Google reviews on our site. Paucitas handles hundreds of cases a year.
An investigation takes from the same day to about two weeks. Every investigation is tailored: you receive a bespoke quote in advance that we go through together, with no surprises. You can always call, 24/7, on +31 20 244 5774. Via the contact form you will hear from us within 1 to 3 hours, and we answer emails within 24 hours, usually the same day.
Sources: FCA, protect yourself from scams; Report Fraud; Police Scotland, scams and frauds.
Questions about your own situation?
Call us directly, 24/7. The first conversation is always free of obligation.
Frequently asked questions about an address poisoning scam
What exactly is address poisoning?
Paucitas explains: a fraudster places an address that looks like one you know in your transaction history, using a tiny or empty transaction. If you copy that address later, your crypto goes to the fraudster.
I sent crypto to the wrong address. Is that always address poisoning?
Paucitas sees in practice that this is not always the case. It can also be a typo or another address of the right recipient. Paucitas works out what happened and where the crypto is now.
Can I get my money back after an address poisoning scam?
Paucitas: that depends on your situation. If you still have access to your own wallet or account holding funds, there may still be options. If everything has been sent to the fraudsters, the picture is different. That cannot be judged from a distance. Paucitas first looks at your situation and tells you honestly what is and is not possible. Be careful with anyone who promises in advance that your money will come back. In doubt? Contact Paucitas and you will know where you stand.
What does Paucitas look into?
Paucitas reads through all conversations, emails, documents and other communication and follows the route of the money from the lookalike address. You get a timeline and a report anyone can follow step by step.
How quickly can Paucitas help and what does it cost?
Paucitas completes an investigation within the same day to about two weeks. You receive a bespoke quote in advance, with no surprises. You can always call, 24/7.
Do you have questions about this blog?
Feel free to get in touch with Paucitas. Paucitas can be reached by phone 24/7, including evenings and weekends. Through the contact form we usually reply within 1 to 3 hours, and we answer e-mail within 24 hours.
From Amsterdam, for the whole of the UK
Everything can be done fully online. Prefer to meet in person? You are very welcome at our office in Amsterdam, by appointment.
Paucitas is an independent expert firm based in the Netherlands that, for clients across the UK, investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.