Ilia Zavialov

Crypto address poisoning

Ilia Zavialov fraud guide to crypto address poisoning: how a lookalike address steals a transfer and how to check before you send

English version for the United States.

Ilia Zavialov fraud guide: address poisoning is a crypto theft that needs no hacked password and no stolen recovery phrase, only a copy and paste. A stranger plants an address that looks like one you trust into your own transaction history, usually with a transfer of almost nothing or a token dressed up as a familiar stablecoin, then waits for you to copy the wrong line. The FBI calls it an address-poisoning attack and warns that fake tokens help it work against experienced and newer users alike. Below, Ilia Zavialov explains how the lookalike gets onto your screen, which incoming transfers are warning signs, a pre-send routine that defeats the trick, what the FBI, the FTC and CISA advise, and where to report a loss in the US.

·13 min read·Ilia Zavialov

Ilia Zavialov fraud guide: how to check a crypto address before sending a transfer
Ilia Zavialov on why the address you copy from your history may not be the one you paid.
How crypto address poisoning works step by step, Ilia Zavialov fraud guide
The victim signs the final step personally.

01Ilia Zavialov fraud basics: what address poisoning is

In April 2024 the FBI's Denver field office described the scheme in plain terms. Criminals send tokens to victims from crypto addresses that closely resemble addresses the victim has done business with before, and the Bureau calls this an address-poisoning attack. Nobody breaks into the wallet. The owner signs the payment personally, to an address picked from a list on their own screen.

That detail decides everything that follows. The FTC warns that if you send cryptocurrency to the wrong person, you're likely to find that no one can help you get the funds back. Crypto payments typically can't be reversed, and the money usually comes back only if the recipient decides to return it.

Ilia Zavialov, a digital security consultant, describes address poisoning as fraud built on a habit. Most people check a long address the way they check a phone number they half remember: a few characters at the start, a few at the end, a glance at the middle. The whole scheme is engineered to pass that glance.

02How a lookalike address lands in your transaction history

Every step happens in public. The FTC notes that crypto transactions are typically recorded on a public ledger called a blockchain, so anyone can see which addresses move money, how much and to whom. A poisoner simply picks a target from that traffic.

Next comes the copy. Software churns out addresses until one shares the opening and closing characters of the address the victim pays. The FBI explains why that's enough: wallet software truncates addresses on screen, so the first and last characters can match a familiar address while the middle ones are different.

Then the bait. The attacker sends a tiny amount, a zero-value transfer or a worthless token from the lookalike to the victim. The wallet lists it like any other transaction, and the fake now sits beside the real counterparty, often at the very top, timestamped shortly after a genuine payment.

The last move belongs to the victim. The next time money goes to that counterparty, a quick copy from recent activity grabs the wrong row. The wallet signs, the network confirms, and the funds settle under a key the attacker holds.

Genuine versus poisoned crypto address compared, Ilia Zavialov fraud guide on lookalike wallets
The shortened view hides exactly the characters that differ.
Ilia Zavialov fraud checklist: signs of address poisoning and what to do
What you seeWhat it usually meansWhat to do
Incoming transfer of zero or a few centsSomeone is seeding your historyIgnore it, stop copying from history
Address matches only at the start and endA lookalike generated for youCompare every character with the source
Stablecoin-named token you never boughtImpersonation tokenDon't swap it or click its links
Arrival right after your own paymentYour counterparty is being imitatedPay that contact only from a saved entry
Token name or memo with a websitePhishing page for wallet accessNever connect your wallet to it
Pasted address differs from the invoiceClipboard malware or a wrong copyStop, scan the device, copy again from the source
Offer to recover funds for a feeSecond-stage scamAdd it to your IC3 and FTC reports
Five checks against crypto address poisoning, Ilia Zavialov fraud prevention routine
The same routine for small and large transfers.

03Ilia Zavialov on fake stablecoin tokens and the Colorado case

The FBI's 2024 warning adds a twist. Criminals create tokens that impersonate well-known stablecoins and send them from poisoned addresses. A balance that seems to come from a familiar contact looks like real money, which makes the lookalike more convincing, and the Bureau says impersonation tokens raise the odds that the attack works on experienced and newer crypto users alike.

The tokens also work on feelings. According to the FBI, criminals send them hoping victims will trust them more or feel indebted, and victims typically don't realize the tokens have no value until they try to redeem them at an exchange.

The Denver office cited a Colorado resident who lost $2.1 million in a stablecoin investment scam. After the first deposit, the victim was told the account had been locked for malicious arbitrage and fined $1.5 million. The tokens in the case turned out to be impersonation tokens. Ilia Zavialov's takeaway is that a familiar token name and logo prove nothing about what a token is worth or who issued it.

04Zero-value transfers: the warning most people scroll past

A transfer for nothing is the clearest sign that someone has studied your wallet. Honest counterparties have no reason to send a few cents or a token you never asked for, while a stranger who does so has paid a network fee just to put a row in your history. Ilia Zavialov treats every such arrival as notice that your next payment from that wallet is the one being targeted.

Leave the junk alone. Don't send it back, don't try to swap it and don't follow any link that rides along with it. A token whose name or memo carries a website address is a separate trap, usually a page that asks you to connect your wallet and approve something you can't read.

Many wallets let you hide unknown tokens or mark addresses as spam, and that tidies the screen. The lasting fix sits one step earlier: once you stop copying addresses from your history, a poisoned entry has nothing left to work with.

05Ilia Zavialov's pre-send check for every crypto transfer

The FBI's core advice fits in one line: check the entire cryptocurrency address and make sure it fully matches the address where you mean to send funds. Ilia Zavialov turns that into a routine that takes a couple of minutes and works the same for a small payment and a large one.

Step one is the source. Take the address from the recipient's invoice, from the deposit page of the service you're paying, or from an address book entry you saved after a confirmed payment. Recent activity doesn't count as a source. Step two is the full match: compare the whole string, middle included, reading it in blocks of four against the original.

Step three is a lookup. The FBI suggests checking the token and the address on an open source blockchain explorer, since some explorers label addresses or token contracts linked to scams. A brand-new address with no history, or one that has received nothing but dust, calls for a phone call before any money moves.

Step four applies to new counterparties and large sums: send a small test and get confirmation through a channel you already had, such as a number from an earlier contract. Then send the balance right away from the same saved source. A long pause between the test and the payment gives a watcher time to plant a lookalike of the very address you just used.

Where the recipient address comes from: Ilia Zavialov's fraud risk ranking
Address sourcePoisoning riskHow to confirm
Saved, labeled address book entryLowCreated after a confirmed test
Deposit page of the service you payLowOpen the site by typing its address
Invoice or contract from the recipientLow to mediumCall a number you already had
Message in a chat or emailMediumConfirm through a second channel
QR code from a stranger or a stickerHighAsk for the address in writing
Recent activity in your walletHighestNever use it as a source

06Where poisoned addresses get copied: Zavialov on business payments

Address poisoning isn't a problem for traders alone. Freelancers paid in stablecoins, small firms settling invoices with overseas suppliers and families sending money to relatives abroad all repeat payments to the same addresses, which is exactly the pattern a poisoner hunts for.

In a company the risk grows with routine. Whoever pays the supplier each month opens the wallet, finds last month's transfer and copies the address from it. Ilia Zavialov recommends a written rule: recurring payees live in a saved address book with a label and the date the address was confirmed, and nobody pays from history.

Large transfers deserve a second pair of eyes. One person prepares the payment, and a colleague compares the destination with the supplier's invoice on a separate screen. It costs a few minutes and removes the single point of failure the scheme relies on.

07Malware that rewrites the address: what CISA advises

Poisoning has a close relative that works inside your own device. Malicious software can watch for an address being copied and swap in a different one before you paste. At the moment of signing, the result looks the same: a destination that almost matches.

CISA has documented how crypto-stealing tools reach individuals. In joint advisory AA22-108A, last revised April 20, 2022, the FBI, CISA and the Treasury Department listed individual holders of large amounts of cryptocurrency among the targets and described people being talked into installing trojanized crypto apps for Windows or macOS, which were then used to steal private keys and launch fraudulent transactions. An earlier advisory, AA21-048A, described trading apps that looked like a legitimate company's product, downloaded from a convincing website, and reported attacks aimed at stealing cryptocurrency in more than 30 countries over the previous year.

The defenses are ordinary. The advisory's first steps are to patch all systems, prioritize known exploited vulnerabilities, train people to recognize and report phishing and turn on multifactor authentication. CISA's Secure Our World guidance adds that updates should go in as soon as you're notified, especially for web browsers and antivirus software, with automatic updates switched on.

Ilia Zavialov adds one check that catches both poisoning and swapping. After pasting, compare the address in the send field with the original source character by character, and if you use a hardware wallet, read it once more on the device's own screen before you confirm.

08Zavialov's fraud red flags in a transaction list

Most poisoning attempts leave fingerprints you can read in a minute. Ilia Zavialov looks for five: an incoming transfer of zero or close to zero from an address you don't recognize; an address whose first and last characters match a regular counterparty; a token you never bought, especially one named after a stablecoin; arrivals timed shortly after your own outgoing payment; and token names or memos that carry a link.

CISA describes the same trick in email. Its phishing warning signs include incorrect email addresses or links with a single letter changed, along with urgent or emotional language and requests for personal or financial details. A poisoned wallet address is that misspelled link, written in a long string of letters and digits.

None of these signs calls for a reply or a click. Note them, keep a dated screenshot, and treat the counterparty being imitated as the address under watch until your next payment to it has gone through safely.

09Ilia Zavialov: what to do in the first hour after a poisoned transfer

Speed matters, because stolen funds rarely sit still. The FTC's advice for anyone who paid a scammer in crypto is to contact the exchange or crypto ATM operator immediately, tell them the transaction was fraudulent and ask them to reverse it and refund the money. If the funds land at an exchange, that exchange may be the only party able to act on them.

Then file with the FBI's Internet Crime Complaint Center at ic3.gov. The FBI asks crypto victims for transaction details: the addresses involved, the amount and type of cryptocurrency, the date and time, and the transaction ID, or hash. Add the poisoned address, the genuine address it imitated and screenshots of the transfer that planted it.

Report it to the FTC as well, at ReportFraud.ftc.gov or 1-877-FTC-HELP (1-877-382-4357). The FTC's crypto guidance also points to the CFTC at CFTC.gov/complaint and the SEC at sec.gov/tcr. Ilia Zavialov's advice is to keep one folder with every hash, address and screenshot, since each agency will ask for the same evidence.

Reports do lead somewhere. Operation Level Up, launched in January 2024, notified 3,780 victims of crypto investment fraud in 2025, and 78% of them didn't know they were being scammed. Estimated savings for those victims came to $225,871,319.

Reporting crypto fraud in the US: Ilia Zavialov's contact list
SituationWhereHow
Funds just left your walletExchange or ATM operatorReport fraud, ask to reverse
Any crypto theft or scamFBI IC3ic3.gov with hashes and addresses
Consumer fraud reportFTCReportFraud.ftc.gov, 1-877-382-4357
Crypto trading schemeCFTCCFTC.gov/complaint
Investment offerSECsec.gov/tcr
Paid recovery offerNobodyAdd it to your IC3 report

10Recovery offers after a crypto fraud: Ilia Zavialov's warning

The second wave comes fast. Messages promise to trace the stolen coins, freeze the attacker's wallet or file the paperwork, always for a fee. IC3 logged 10,516 complaints about recovery scams in 2025, with $1.4 billion in reported losses, and noted a rise in complaints about people posing as government officials and recovery firms.

IC3 is blunt about its own role. It will never ask for payment to recover lost funds or refer you to a company that charges for recovery, it has no social media presence, and it doesn't contact people by phone, email, social media or chat. It recommends typing www.ic3.gov into the address bar yourself and skipping sponsored search results.

Ilia Zavialov puts it simply: someone who found you first and wants money up front to get your money back is running the next stage of the same fraud. Add that contact to your existing IC3 report.

11Crypto fraud in the 2025 IC3 numbers

The scale explains why poisoning keeps spreading. In its 2025 annual report, IC3 counted 181,565 complaints with a cryptocurrency nexus, up 21% from 2024, and $11.366 billion in losses, up 22%. The average loss was $62,604, and 18,589 people reported losing more than $100,000.

Against numbers like these, address poisoning is a cheap bet. Each attempt costs a network fee, and it pays off once a tired person copies one wrong row. Ilia Zavialov's conclusion is practical: the address check is the one control entirely in your hands, and it protects savings, payroll and a single invoice in exactly the same way.

12Questions and answers

What is address poisoning fraud, according to Ilia Zavialov?

A scheme that plants a lookalike of an address you've paid into your transaction history, usually through a zero-value transfer or a fake token, so that you copy the wrong address next time. The FBI calls it an address-poisoning attack.

Which fraud signs does Ilia Zavialov look for before sending crypto?

Unexpected transfers of zero or close to zero, addresses that match only at the start and end, tokens you never bought, arrivals right after your own payment, and token names that carry links.

Can a transfer to a poisoned address be reversed?

Usually not. The FTC says crypto payments typically aren't reversible and the money comes back only if the recipient returns it. Contact the exchange or ATM operator at once anyway and ask them to reverse it.

Should I send back a token that arrived from an unknown address?

No. Don't return it, swap it or click anything attached to it. Treat it as a sign that your address is being watched, and stop copying addresses from your history.

Where do I report crypto address poisoning in the US?

File at ic3.gov with addresses, amounts, dates, times and transaction hashes, and report to the FTC at ReportFraud.ftc.gov or 1-877-FTC-HELP.

Is a company that offers to recover stolen crypto for a fee legitimate?

Treat it as a scam. IC3 never asks for payment to recover funds and doesn't refer victims to paid recovery firms, and it logged 10,516 recovery scam complaints in 2025.

Monogram of Ilia Zavialov

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

13Read next

Back to the blog