Ilia Zavialov fraud guide to crypto address poisoning: how a lookalike address steals a transfer and how to check before you send

01Ilia Zavialov fraud explainer: the trick behind a poisoned address

Address poisoning aims at a single moment: the second you copy an address. You open your wallet, find the supplier or friend you paid last month, copy the address and send. If a stranger has managed to slip a near-identical address into that list, the copy can pick up theirs, and the transfer goes exactly where you told it to go.

Nothing gets hacked on the way. The wallet, the recovery phrase and the device all behave correctly, and the signature on the payment is yours. That is why strong passwords and two-step log-ins, useful as they are elsewhere, make no difference here.

Ilia Zavialov, a digital security consultant, calls it fraud by imitation. The scheme relies on people checking a long string of characters the way they check a postcode, by glancing at how it starts and how it ends.

02Why the shortened address on screen helps the fraudster

Most wallet apps display an address in shortened form: a handful of characters, a row of dots, a handful more. It keeps the screen tidy, and it hides the middle of the string, which is precisely where a lookalike differs from the real thing.

Producing such a lookalike takes computing time and little else. A program generates addresses until one begins and ends like the target, and the longer the matching ends, the more attempts it needs. Fraudsters settle for whatever is enough to survive a quick look.

The target is easy to find, because blockchains are public. Anyone can see which addresses you pay, how much and how often, so a regular payment to the same counterparty is an open invitation. Ilia Zavialov points out that careful, experienced users fall for this as readily as newcomers, since the trick exploits a shortcut everyone takes.

03Ilia Zavialov on dust, zero-value transfers and copycat tokens

To get the lookalike into your history, the fraudster sends something to your wallet from it: a fraction of a penny, a transfer of zero, or a token that copies the name and logo of a popular stablecoin. Your wallet records it like any other incoming transaction.

Copycat tokens deserve particular suspicion. Creating a token and giving it any name costs very little, so a balance labelled with a familiar ticker may be worth nothing at all. People who try to sell one sometimes land on a website asking them to connect their wallet, which opens a second route to theft.

Ilia Zavialov's rule is to read any unexpected arrival as a notice: someone is studying this wallet. Don't send it back, don't swap it and don't visit any site named in it. Leave it where it is and change how you pick addresses from then on.

Hiding unknown tokens in the wallet settings keeps the screen cleaner and makes a careless copy less likely. It does not remove the lookalike from the public record, so the same address can turn up again in another list or in an explorer search.

04Zavialov's routine before every transfer

The fix is a habit that takes a couple of minutes. Ilia Zavialov starts with the source: the address must come from the recipient's invoice, the deposit page of the platform you're paying, or a labelled contact you saved after a payment was confirmed. Your recent transactions are never a source.

Next, compare the full string. Read it in groups of four against the original, and give the middle the same attention as the ends. On a hardware wallet, repeat the comparison on the device's own screen before approving.

For a new payee or a large sum, send a small test first and confirm it arrived using contact details you already held, such as a phone number from an earlier contract. Then send the remainder promptly from the same saved source; a long gap gives a watcher time to plant a lookalike of the address you have just used.

Finally, paste the address into a public blockchain explorer. A brand-new address with no history, or one whose only activity is a stream of tiny incoming transfers, is a reason to stop and ring the recipient.

05Paying suppliers and staff in crypto: a fraud risk for UK businesses

Recurring payments are the easiest target. A small business that settles an overseas supplier's invoice in stablecoins each month, or pays contractors in crypto, produces exactly the regular pattern a poisoner looks for on the public ledger.

Ilia Zavialov suggests putting the rules in writing. Payees are stored in a labelled address book with the date and method of confirmation; no one copies from transaction history; a change of address is accepted only after a call to a number already on file.

Larger transfers need two people. One prepares the payment, another compares the destination with the invoice on a separate screen and signs off. The extra few minutes remove the single point of failure that address poisoning depends on.

Keep the paperwork tidy as well. A payment log listing the invoice, the confirmed address, who checked it and the transaction hash makes reconciliation easier for the accountant, and if a lookalike ever slips through, it gives the police a timeline on day one.

06Ilia Zavialov on why UK protections rarely cover crypto losses

Report Fraud is plain about the gap. Most crypto activity in the UK is unregulated, which means no access to the Financial Ombudsman Service if you want to complain and no Financial Services Compensation Scheme if a firm goes out of business. The FCA goes further: anyone investing in crypto should be prepared to lose all the money they put in.

Bank reimbursement rarely helps either. The Payment Systems Regulator's rules cover payments made in the UK into a UK account the customer doesn't control, so a transfer to your own crypto account falls outside them, and the poisoned transfer itself happens on a blockchain that no UK bank runs.

What you can do is check who you deal with. Firms offering crypto products in the UK must be registered with the FCA or have permission to promote them, and the Financial Services Register lets you search by name or firm reference number and compare the contact details you were given. Of 2,329 warnings the FCA issued in 2025, 1,528 concerned unauthorised crypto firms and their promotions.

07Malware, copycat apps and lookalike websites

A related attack works inside your own device. Malicious software watches the clipboard, recognises a crypto address when you copy one, and swaps in another before you paste. The address in the send field then looks almost right, which is the whole point.

Police Scotland warns that fraudsters build realistic websites and apps, and advises never sharing a wallet's seed phrase, never allowing remote access to your devices and never letting someone else set up a crypto wallet for you. Ilia Zavialov adds a simple habit: install wallet software only via a link on the developer's own site, typed in by hand, and keep the phone and computer updated.

Suspicious messages that point you towards a wallet site can be reported. GOV.UK asks people to forward scam emails to report@phishing.gov.uk for the NCSC to check and to send suspicious texts free to 7726. The NCSC says that by July 2026 it had received more than 58 million reports, leading to the removal of 256,000 scams across 454,800 web addresses.

08Reading your wallet history like an investigator: Zavialov's checklist

Poisoning attempts usually leave visible traces. Ilia Zavialov checks for incoming transfers of zero or close to it from unknown addresses; addresses that share only their opening and closing characters with a regular payee; tokens you never bought, especially ones named after stablecoins; arrivals that turn up minutes after your own payment; and token names that include a web link.

Any one of these is a reason to slow down. Take a dated screenshot, note which genuine contact is being imitated, and make sure the next payment to that contact comes from your saved address book.

The same log becomes evidence if something goes wrong. A clear record of when the lookalike arrived and what it imitated helps police and any platform involved to follow the funds.

Ilia Zavialov suggests a quick look at the history once a week for anyone who pays the same people regularly. A few minutes spent spotting a lookalike before a payment is worth far more than an afternoon spent explaining one to the police afterwards.

09Ilia Zavialov: reporting crypto fraud in England, Wales, Northern Ireland and Scotland

Act in the first hour. If the coins went to or through a platform, contact it at once, explain that the transfer was fraud and ask whether the receiving account can be frozen. Then gather the transaction hash, both addresses, the amount, the date and time, and screenshots of the lookalike's first appearance.

In England, Wales and Northern Ireland, report to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, contact Police Scotland on 101. Citizens Advice notes that Report Fraud issues a crime reference number, and banks find it useful when you get in touch.

If a firm was involved, or you suspect you were contacted by a fraudster posing as one, the FCA takes reports on 0800 111 6768. Ilia Zavialov recommends keeping every report, reference and screenshot in a single folder, as each organisation will ask for much the same detail.

10Recovery offers: Ilia Zavialov on the second approach

Losing money once puts you on another list. The FCA warns that fraudsters may target the same person again or sell their details to other criminals, and that the follow-up may be an offer to get the money back or to buy back the investment, in return for a fee.

The National Crime Agency frames the loss correctly: money lost in a crypto investment fraud was stolen, and calling it a trading loss misses the point. That framing matters when you report it and when someone offers to recover it for a fee.

Ilia Zavialov's advice is short. Anyone who contacts you first and wants payment up front to retrieve stolen crypto belongs in your next report to Report Fraud or Police Scotland, with their messages attached.

11Crypto fraud in the UK: what the official figures show

The official picture points one way. Report Fraud describes crypto investment fraud as one of the fastest growing types of fraud in the UK, and the FCA says reports to it about crypto investment scams have more than doubled since 2020.

Crypto also turns up inside other frauds. Report Fraud counted more than £102 million lost to romance fraud in 2025 across 10,784 reports and notes that these cases are often combined with fake investments, crypto included. Address poisoning needs none of that persuasion, only a wallet that pays the same people more than once.

Ilia Zavialov draws a practical conclusion from these numbers. The checks that stop a poisoned transfer cost nothing, need no app and work the same for a household sending money to family abroad and for a company paying a supplier.

12Questions and answers

13Read next

• Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
• Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
• Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
• Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
• Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
• Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
• Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
• Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
• Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
• Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
• Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
• Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
• Ilia Zavialov on hardware wallet scams: tampered boxes, pre-printed seed phrases and fake replacements Fake hardware wallet scams
• Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
• Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
• Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
• Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
• Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
• Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
• Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
• Ilia Zavialov on Telegram bot scams: wallet bots, tap-to-earn games and fake support Telegram bot and Mini App scams
• Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
• Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
• Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
• Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers

Back to the blog