Address poisoning: what practitioners need to act on now

TL;DR: Address poisoning is no longer a crude copy-paste scam: Blockaid reports 65.4 million poisoning transactions since January 2025, with about 316,000 confirmed attacks and a recent Safe{Wallet} campaign that created roughly 15,000 malicious proxy addresses. The control gap is not just user vigilance but UI trust boundaries, verified recipient workflows, and the economics of mass poisoning.

Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “Address Poisoning: The Growing Threat Draining Millions from Crypto Users”.

By the numbers:

• Since January 2025, Blockaid has flagged over 65.4 million address poisoning transactions on-chain.
• Blockaid reports January 2026 poisoning attempts rose from 628,000 in November 2025 to 3.4 million in January 2026.

Key questions

Q: What fails when users rely on wallet transaction history to verify recipients?

A: The failure is a broken trust model.

Q: Why do lookalike blockchain addresses create such a high fraud risk?

A: Because human verification is weak against long hexadecimal strings.

Q: What are the signs that a wallet workflow is being poisoned?

A: Common signs include unfamiliar addresses appearing in history, unexpected nested accounts or contacts in the UI, repeated dust transfers from unknown sources, and recipients that closely mirror known destinations.

Practitioner guidance

• Eliminate transaction-history recipient selection Require users to pull recipients from a verified address book, bookmarked source, or separate confirmation channel instead of copying from recent wallet activity.
• Harden wallet UI trust boundaries Review any feature that inserts external objects into the wallet view, including nested accounts, address suggestions, and recent-contact lists, and flag them as untrusted until explicitly verified.
• Verify full address match, not partial prefixes Train users to compare the complete recipient string, including the middle characters, because attackers deliberately mirror the parts most people check.

Bottom line: Address poisoning exploits human verification shortcuts and wallet UI trust, not a protocol flaw.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →