Address poisoning and dusting
A scammer sends you a tiny transaction (called "dusting") from an address that looks almost identical to one you use, hoping you'll copy it from your history and send crypto to the wrong place. Dust can also be used to track wallets or to push a fake token.
How it works
- 1The scammer watches the blockchain for addresses that send and receive often.
- 2They create a lookalike address that matches the first and last few characters of one you've used.
- 3They send you a tiny or zero-value transaction so their address appears in your history.
- 4Later, you copy the wrong address from your history and send your crypto to the scammer.
- 5Dust is sometimes used for other tricks too: tracking which addresses belong to one person, or leaving a fake token with a website in its name that leads to a scam.
A realistic example (fictional)
Maya copies a recent address from her transaction history to send USDC to a contact. She doesn't check the middle characters. The address was a lookalike, and the USDC is gone.
Warning signs
- Tiny or zero-value transactions from addresses you don't recognise
- An address that looks nearly the same as one you've used
- Addresses that match only at the start and end
- Unexpected tiny amounts or unknown tokens, especially with a website or link in the name
- Pressure to send quickly without checking
What to do
Haven't sent anything?
Don't copy addresses from your transaction history. Use your saved contacts, or ask the recipient to share the address again.
Already sent something?
- Stop. Don't send any more to that address.
- Save the transaction ID and both addresses.
- Contact Support to report it.
- Be aware that completed blockchain transactions generally can't be reversed.
Protect yourself
- Check the full address, character by character, before you send.
- Send a small test amount first when you can.
- Save trusted addresses as contacts.
- Ignore unexpected tiny transactions and unknown tokens. Don't click links in a token name.
Report it
Tell us first, then the authorities. See all the ways to report.
Authorities: FBI IC3 (ic3.gov) · your local police · your bank or card issuer if you paid that way.