# Address Poisoning Tracker: Lookalike Address Scams

> Address poisoning tracker: zero-value transfer scams and USDT dust transfers that plant lookalike addresses, and the funds victims later send to them, by day.

Markdown copy of https://voltfincrypto.com/apps/address-poisoning-tracker

**Question:** How many lookalike-address poisoning transfers hit wallets each day, and how much was later sent to the poisoned addresses?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain, Ethereum, BNB Chain, Tron
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

Address poisoning plants a fake address in a wallet's history that starts and ends with the same characters as one the wallet really pays. The attacker sends a zero-value or tiny transfer, or a counterfeit token, so the lookalike appears next to genuine payments; a victim who later copies an address from that history sends funds to the attacker. This dashboard counts those poisoning transfers each day and the payments that fell for them.

A poisoning transfer is matched to its target by comparing the lookalike's first and last characters with the victim's recent real counterparties. The losses figure counts only later transfers from a victim to a lookalike it was poisoned with, so each one links to both the poisoning transfer and the mistaken payment.

## Blueprint

### Daily

Poisoning transfers and the wallets they target, per day and chain.

- **Poisoning transfers** (count): Poisoning transfers detected on the latest complete day: zero-value, dust and counterfeit-token transfers from lookalike addresses.
- **Wallets targeted** (count): Distinct wallets that received at least one poisoning transfer on the latest complete day.
- **New lookalike addresses** (count): Lookalike addresses first seen sending poisoning transfers on the latest complete day.
- **Share of stablecoin transfers** (%): Poisoning transfers as a share of all stablecoin transfers on the selected chain on the latest complete day.
- **Poisoning transfers by method** (count): Poisoning transfers per day, split by method: zero-value transferFrom, dust transfer and counterfeit token.

### Losses

Payments sent to lookalike addresses and how they were set up.

- **Sent to lookalikes** (USD): Value victims sent to lookalike addresses they were poisoned with, over the selected period.
- **Victims** (count): Distinct victims who sent funds to a lookalike address in the selected period.
- **Losses by day** (USD): Value sent to lookalike addresses per day, per chain, valued at the block of each payment.
- **Largest mistaken payments**: The largest payments to lookalikes with chain, token, amount, the poisoning transfer and how many characters matched.

Filters: Chain (Ethereum, BNB Chain, Tron and the other covered chains); Period (Last 7, 30 or 90 days).

## How it will be measured

- Candidate poisoning transfers are ERC-20 and TRC-20 Transfer logs of zero or dust value, including zero-value transferFrom calls that a third party made from the victim's address.
- A transfer counts as poisoning when the counterparty is a fresh address that shares at least its first four and last four hex characters with an address the victim really paid or was paid by in the previous 30 days.
- Counterfeit tokens that copy a real token's symbol are flagged when the token contract is not the registry's contract for that symbol.
- A loss is a later non-dust transfer from the victim to a lookalike it was poisoned with, valued at oracle or DEX pool prices at that block.

## Data it needs

- `stablecoin_flows_daily` (to build): Stablecoin mints, burns, transfer volume and active addresses per stablecoin and chain per day.
- `token_transfers_daily` (to build): ERC-20 and native transfer counts, volume and unique senders and receivers per token per chain per day.
- `stablecoins` (published): Every tracked stablecoin contract: issuer, peg, chain, decimals and whether it is native or bridged.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: ERC-20 and TRC-20 Transfer logs with zero or dust value, including zero-value transferFrom calls made by third parties
- Source: Each victim's real counterparties over the previous 30 days, for prefix and suffix matching against senders
- Source: Later non-dust transfers from victims to the lookalike addresses
- Source: Token contracts that copy a registry token's symbol, for counterfeit-token poisoning
- Source: USDT and USDC transfer values per block

## Questions

### What is an address poisoning attack?

An attacker creates an address that looks like one you use, with the same opening and closing characters, and makes it appear in your transaction history through a tiny or zero-value transfer. If you later copy that address from your history, the payment goes to the attacker.

### Why did I receive a zero-value transfer from an unknown address?

A zero-value or dust transfer from an address that resembles one of your counterparties is the usual sign of address poisoning. It cannot move your funds by itself; the risk is copying that address later. Many tokens let anyone trigger a zero-value transfer that appears to come from you.

### Can address poisoning steal funds without my action?

No. The poisoning transfer only adds a lookalike entry to your history; funds move only if you send to that address yourself. That is why the losses figure counts only payments from a victim to the exact lookalike it was poisoned with.

### Why is address poisoning common with USDT?

USDT moves in large amounts between repeat counterparties on Tron, Ethereum and BNB Chain, which gives attackers many histories to copy, and on chains with low fees poisoning transfers are cheap to send in bulk.

### How do attackers create lookalike addresses?

They run vanity address generators that try key pairs until one matches the wanted first and last characters. Each extra character makes the search much harder, so lookalikes match the ends of an address, never the middle, which is where a careful check catches them.

## Glossary

- **Lookalike address**: An address generated to share its first and last characters with a target address, so a shortened display shows the two as identical.
- **Dust transfer**: A transfer of a tiny amount, sent to place an entry in a wallet's history rather than to pay anything.
- **Zero-value transferFrom**: A token call that moves nothing but emits a Transfer event; many tokens let anyone make one that appears to come from another address.

## Related apps

- [Wallet Drainer Tracker: Phishing Losses by Month](https://voltfincrypto.com/apps/wallet-drainer-tracker)
- [Crypto Address Checker: Flagged, Sanctioned or Hacked](https://voltfincrypto.com/apps/crypto-address-checker)
- [USDT on Tron: Supply and Daily Transfers](https://voltfincrypto.com/apps/usdt-on-tron)
- [Stablecoin Transfer Volume, Adjusted for Bots](https://voltfincrypto.com/apps/stablecoin-transfer-volume-adjusted)
- [Token Approval Checker: Open Allowances by Wallet](https://voltfincrypto.com/apps/token-approval-checker)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F