Ethereum Poisoning Attacks: How to Protect Yourself From Scammers

Address poisoning attacks, a fraudulent scheme designed to trick users into sending funds to incorrect cryptocurrency wallets, are increasingly targeting Ethereum users. What was once sporadic spam has evolved into a pervasive, automated operation, according to recent data.

Escalating Threat and Tactics

A recent incident highlighted the severity of the issue, where an Ethereum user reported receiving over 89 Etherscan Address Watch alerts after making only two stablecoin transfers. These alerts were triggered by numerous small, fraudulent transactions sent to the user's wallet as part of an address poisoning campaign.

The core tactic involves attackers monitoring blockchain activity for legitimate transactions. They then create addresses that closely resemble the beginning and end characters of previously used wallets. Small, often negligible, transactions are sent from these fabricated addresses. Because many wallet interfaces and blockchain explorers prominently display recent transaction history, the poisoned address appears alongside legitimate ones.

Significant Financial Impact and Contributing Factors

The risks are substantial, as users may inadvertently copy a poisoned address when intending to send funds later. Between July 2022 and June 2024, approximately 17 million poisoning attempts were made against an estimated 1.3 million Ethereum users, resulting in confirmed losses exceeding $79 million.

The rise in these attacks is attributed to basic economic principles and network improvements. Despite a low success rate of around 0.1% per attempt, attackers compensate by sending a massive volume of poison transfers. Furthermore, reduced network fees following Ethereum's Fusaka upgrade have made it more cost-effective for attackers to execute millions of these small transactions.