What Is Address Poisoning? The Copy-Paste Scam Draining Wallets

Address poisoning does not break your wallet or steal your keys. It exploits a lazy habit almost everyone has: reading only the first and last few characters of a long crypto address. An attacker seeds your transaction history with a lookalike address, waits for you to copy it by mistake, and lets you send real funds straight to them. This guide explains exactly how the trick works, why Solana wallets are a favorite target, and the handful of habits that make you effectively immune to it.

What address poisoning actually is

A Solana address is a long base58 string like 7xKQ...9fZa. Nobody memorizes it, and almost nobody reads the full thing. When you check an address, you glance at the first four or five characters and the last four or five, see that they match what you expect, and move on. Address poisoning is built entirely around that shortcut.

The attacker generates a vanity address that shares those same visible endpoints with an address you use often, then plants it inside your own transaction history so it looks familiar and trusted. Later, when you go to send funds and copy a "known" address from your recent activity, you grab the attacker's lookalike instead of the real one. The wallet does exactly what you told it to and sends your crypto to the scammer. There is no exploit in the code and no signature the attacker needs from you beyond your normal send. The whole con lives in that one moment of copy-paste.

This is fundamentally different from a phishing drainer. It does not need your recovery phrase, and it does not trick you into approving a malicious transaction. That makes it easy to underrate. Unlike a seed phrase leak, poisoning never touches your keys at all. It only needs you to be in a hurry.

How the copy-paste trap works, step by step

The mechanics are simple, which is part of why the scam scales so well:

• Step 1 — They study your history. Solana is a public ledger. Anyone can see which addresses you send to repeatedly: your exchange deposit address, a second wallet of yours, a friend you pay often.
• Step 2 — They mint a lookalike. Using vanity-address software, they brute-force an address that starts and ends with the same characters as one of your frequent destinations. Matching a handful of characters at each end is cheap; matching the entire address is not, so they only ever fake the parts you actually look at.
• Step 3 — They poison your feed. They send a tiny, zero-value, or fake-token transaction from that lookalike address to your wallet. The point is not the money. The point is to get their address to appear in your transaction history, sitting right next to the real one.
• Step 4 — They wait. Days or weeks later you need to send funds to that destination. You open your history, copy the address that "looks right," paste, and send. Because the ends match, nothing feels wrong.

The trap only springs when you copy an address from your activity instead of from a source you actually control. That single behavior is the entire attack surface, which is also good news, because it means the entire attack surface is one habit you can change.

Why Solana wallets are an easy target

Address poisoning exists on every chain, but a few properties make Solana especially fertile ground for it.

First, the addresses. Base58 Solana addresses are long, dense, and unmemorable, so the "check the ends and trust it" habit is nearly universal here. Second, transactions are fast and extremely cheap, which means an attacker can spray poisoning transactions at thousands of wallets for a trivial cost and simply wait for a fraction of them to slip up. Third, sending unsolicited tokens is easy: dropping a fake "USDC" token or a speck of SOL into a stranger's wallet takes almost nothing, and the token then sits in that wallet's history looking legitimate.

Put together, the economics favor the attacker. Poisoning a huge number of wallets is close to free, and it only has to work once in a while to pay off. If you want to inspect exactly what landed in your wallet and where it came from, a block explorer like the ones covered in our Solscan guide lets you trace any suspicious entry back to its source.

The variants you will run into

Poisoning shows up in a few recognizable shapes. They all share the same goal: get a hostile lookalike address into your activity feed.

• Zero-value transfer poisoning. A transaction crafted so the attacker's lookalike address appears in your history without actually moving anything of value. It is pure decoration for your feed, designed only to be copied later.
• Dust and fake-token airdrops. The attacker sends a tiny amount of SOL or, more commonly, a counterfeit token named to look real, such as a fake "USDC" or "USDT" entry. Some fake tokens even carry a website or "claim" link in their metadata, which is a second scam layered on the first. Do not click those links.
• Lookalike entries seeded into your feed. The broad version of all of the above: any dust or junk transaction whose only purpose is to leave a scammer-controlled address in your recent activity, positioned so it reads as one you already use.

Notice what none of these require: they never ask you to sign anything, connect to a site, or reveal a key. That is what separates poisoning from an approval-based drain, where the fix is to revoke the malicious approval. With poisoning there is nothing to revoke, because you have not granted the attacker anything. You simply have not sent them money yet.

How to never fall for it

This is the part that matters. Poisoning is one of the few crypto scams you can shut down completely with habits alone, because the attack depends entirely on how you handle addresses when you send. Adopt these and the trap has nothing to spring on.

• Never copy an address from your transaction history. This is the single most important rule. Your history is exactly where the attacker planted their bait. Treat every address in your activity feed as untrusted for the purpose of sending.
• Keep a saved address book. Maintain a whitelist of verified addresses you actually control or trust, saved in your wallet's contacts or a secure note. When you send, pick the destination from that list, never from a recent-activity screen.
• Verify the entire address, not just the ends. If you must paste a fresh address, compare the whole string against a trusted source, character by character in the middle as well. The middle is precisely what the attacker did not fake, so that is where a lookalike gives itself away.
• Send a small test transaction first. For any large or first-time transfer, send a tiny amount, confirm it arrived at the correct wallet, and only then send the rest. A few cents of fees is cheap insurance against sending everything to a scammer.
• Use a hardware wallet that shows the full address on-device. Malware can alter what your screen displays, but a hardware wallet shows the real destination on its own trusted screen for you to confirm. Read it there before approving.
• Ignore and hide unsolicited dust and fake tokens. Do not interact with random tokens or dust that appear in your wallet. Do not "claim," do not click links in their metadata, and do not send them anywhere. Hide them and move on. Engaging is exactly what the attacker wants.

When poisoning actually bites: manual sends

It is worth being precise about when this risk is live, because it is not always. Address poisoning only threatens you during a manual, wallet-to-wallet send: withdrawing to an exchange, moving funds between your own wallets, or paying someone directly by pasting their address. Those are the exact moments the copy-paste mistake happens.

Ordinary token trading is a different motion. When you swap one token for another inside a wallet or trading app, you are not typing a destination address at all, so there is no address to poison. The danger appears specifically when you leave the trading flow and manually send funds out. Slow down for those transactions in particular, and the rest of your activity is largely unaffected. Poisoning is also a close cousin of the broader family of Solana wallet drainer scams and the social-engineering plays in Telegram crypto scams, which all rely on you trusting something you should have verified.

How MoonHydra fits

MoonHydra is a non-custodial Solana trading bot inside Telegram, and it is worth being honest about where poisoning does and does not reach you here. When you trade in MoonHydra, you buy and sell by pasting a token contract address and routing the swap through the Jupiter aggregator, not by sending funds wallet-to-wallet. So the classic copy-paste poisoning mistake mostly does not apply to the act of trading itself. Your keys are encrypted at rest with AES-256-GCM, you hold your own funds, and there are no custom smart contracts of ours in the path. Pricing is a flat 1% per trade on buys and sells, with no subscription.

Where you still need to stay careful is withdrawals. The moment you move SOL or tokens out of a Hydra Head wallet to an external address, you are doing exactly the kind of manual send that poisoning targets. Paste that destination from your own saved address book, verify the full string, and send a small test first for anything large. MoonHydra cannot protect you from an address you paste yourself, and no bot can. The verification is yours to do.

Bottom line

Address poisoning is a patience game that ends with you doing the damage. The attacker plants a lookalike address in your history and waits for one hurried copy-paste. Because the whole scam hinges on that habit, the defense is almost absurdly simple: never copy an address from your transaction history, keep a saved whitelist, verify the entire string rather than just the ends, and send a small test transaction before anything large. Do those four things and poisoning has no way in, no matter how many fake tokens land in your wallet.

Next: shore up your key hygiene with what a seed phrase is and how to protect it, contain your risk with a dedicated burner wallet setup, and learn to trace suspicious entries with our Solscan guide. When you are ready to trade with a non-custodial wallet, start at t.me/moonhydrabot.