Poisoning transfers
countPoisoning transfers detected on the latest complete day: zero-value, dust and counterfeit-token transfers from lookalike addresses.
Dashboard · VantagePlanned
Address Poisoning Tracker: Lookalike Address Scams
How many lookalike-address poisoning transfers hit wallets each day, and how much was later sent to the poisoned addresses?
Lookalike addresses planted in wallet histories with zero-value and dust transfers, and the funds victims later send to them.
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
Daily
Poisoning transfers and the wallets they target, per day and chain.
Wallets targeted
countDistinct wallets that received at least one poisoning transfer on the latest complete day.
New lookalike addresses
countLookalike addresses first seen sending poisoning transfers on the latest complete day.
Share of stablecoin transfers
%Poisoning transfers as a share of all stablecoin transfers on the selected chain on the latest complete day.
Poisoning transfers by method
countPoisoning transfers per day, split by method: zero-value transferFrom, dust transfer and counterfeit token.
Losses
Payments sent to lookalike addresses and how they were set up.
Sent to lookalikes
USDValue victims sent to lookalike addresses they were poisoned with, over the selected period.
Victims
countDistinct victims who sent funds to a lookalike address in the selected period.
Losses by day
USDValue sent to lookalike addresses per day, per chain, valued at the block of each payment.
Largest mistaken payments
The largest payments to lookalikes with chain, token, amount, the poisoning transfer and how many characters matched.
- Chain
- Ethereum, BNB Chain, Tron and the other covered chains
- Period
- Last 7, 30 or 90 days
About
What it answers, and for whom.
Address poisoning plants a fake address in a wallet's history that starts and ends with the same characters as one the wallet really pays. The attacker sends a zero-value or tiny transfer, or a counterfeit token, so the lookalike appears next to genuine payments; a victim who later copies an address from that history sends funds to the attacker. This dashboard counts those poisoning transfers each day and the payments that fell for them.
A poisoning transfer is matched to its target by comparing the lookalike's first and last characters with the victim's recent real counterparties. The losses figure counts only later transfers from a victim to a lookalike it was poisoned with, so each one links to both the poisoning transfer and the mistaken payment.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Candidate poisoning transfers are ERC-20 and TRC-20 Transfer logs of zero or dust value, including zero-value transferFrom calls that a third party made from the victim's address.
- A transfer counts as poisoning when the counterparty is a fresh address that shares at least its first four and last four hex characters with an address the victim really paid or was paid by in the previous 30 days.
- Counterfeit tokens that copy a real token's symbol are flagged when the token contract is not the registry's contract for that symbol.
- A loss is a later non-dust transfer from the victim to a lookalike it was poisoned with, valued at oracle or DEX pool prices at that block.
The data it needs
Read from chain state and history
- stablecoin_flows_dailyTo buildStablecoin mints, burns and transfersStablecoin mints, burns, transfer volume and active addresses per stablecoin and chain per day.
- token_transfers_dailyTo buildToken transfer volumeERC-20 and native transfer counts, volume and unique senders and receivers per token per chain per day.
- stablecoinsPublishedStablecoin registryEvery tracked stablecoin contract: issuer, peg, chain, decimals and whether it is native or bridged.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- ERC-20 and TRC-20 Transfer logs with zero or dust value, including zero-value transferFrom calls made by third parties
- Each victim's real counterparties over the previous 30 days, for prefix and suffix matching against senders
- Later non-dust transfers from victims to the lookalike addresses
- Token contracts that copy a registry token's symbol, for counterfeit-token poisoning
- USDT and USDC transfer values per block
Questions
Questions people ask.
What is an address poisoning attack?
An attacker creates an address that looks like one you use, with the same opening and closing characters, and makes it appear in your transaction history through a tiny or zero-value transfer. If you later copy that address from your history, the payment goes to the attacker.
Why did I receive a zero-value transfer from an unknown address?
A zero-value or dust transfer from an address that resembles one of your counterparties is the usual sign of address poisoning. It cannot move your funds by itself; the risk is copying that address later. Many tokens let anyone trigger a zero-value transfer that appears to come from you.
Can address poisoning steal funds without my action?
No. The poisoning transfer only adds a lookalike entry to your history; funds move only if you send to that address yourself. That is why the losses figure counts only payments from a victim to the exact lookalike it was poisoned with.
Why is address poisoning common with USDT?
USDT moves in large amounts between repeat counterparties on Tron, Ethereum and BNB Chain, which gives attackers many histories to copy, and on chains with low fees poisoning transfers are cheap to send in bulk.
How do attackers create lookalike addresses?
They run vanity address generators that try key pairs until one matches the wanted first and last characters. Each extra character makes the search much harder, so lookalikes match the ends of an address, never the middle, which is where a careful check catches them.
- Lookalike address
- An address generated to share its first and last characters with a target address, so a shortened display shows the two as identical.
- Dust transfer
- A transfer of a tiny amount, sent to place an entry in a wallet's history rather than to pay anything.
- Zero-value transferFrom
- A token call that moves nothing but emits a Transfer event; many tokens let anyone make one that appears to come from another address.
Related
More apps like this.
Wallet Drainer Tracker: Phishing Losses by Month
What wallet drainers take each month, on which chains and through which signatures: approvals, permits, NFT listings and delegations.
Multi-chainEthereumCrypto Address Checker: Flagged, Sanctioned or Hacked
Check an address before you send or accept funds: direct flags and one-hop links to sanctioned, frozen, hacked or phishing addresses.
Multi-chainEthereumTron+1USDT on Tron: Supply and Daily Transfers
How much USDT lives on Tron and how much of it moves each day: supply, issuance, transfers, sending accounts and transfer sizes.
TronStablecoin Transfer Volume, Adjusted for Bots
How much value stablecoins really move each day once bot loops, internal hops and round trips are removed, by chain and by coin.
Multi-chainEthereumTron+3Token Approval Checker: Open Allowances by Wallet
Every spender that can still move a wallet's tokens or NFTs, with the allowance, when it was granted and the transaction that set it.
Multi-chainNorth Korea Crypto Hacks: Lazarus Group Theft Tracker
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinBuild Address Poisoning Tracker: Lookalike Address Scams on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.