Address poisoning: how the look-alike address scam works, and how to check before you send

· 3 min read · KadenaTrace

Address poisoning does not touch your keys. It relies on one habit: copying an address from your own transaction history. The scammer plants an address there that looks like one you use, and waits. This guide shows how it happened in case KT-20, reported on October 28, 2026, where a victim sent about $50,000 in USDT to the wrong address on Ethereum, and how to check an address before you send.

How the trick works

  1. The scammer watches the chain for addresses you send to often: an exchange deposit, a partner, your own cold wallet.
  2. They generate a new address whose first and last characters match the one you use. The middle differs, but wallets and explorers shorten addresses to their ends, so the two look the same on screen. In KT-20 the real address and the poisoned one both began with 0xd967 and both ended with 16f9.
  3. They send you a tiny transfer from that look-alike, often zero tokens or dust. Now it sits in your history, one line above the real one.
  4. Next time you copy "the address I always use" from your history, you copy theirs.

Some variants use a fake token whose contract writes a "transfer from you" into your history, so the look-alike appears as if you had sent to it before. Either way, the point is the same: the list you trust has been edited.

What happened in KT-20

On October 28, 2026, @realScamSniffer reported a victim losing about $50,000 in USDT to a poisoned address. KadenaTrace's trace of the receiving address shows $52,097 moving out on October 30 and $49,992 swapped on Uniswap in the same minute; nothing was left in the traced wallets. The case was registered on Kadena as KT-20 and is watched. The source does not report any freeze or recovery.

Two checks that stop it

Check the whole address, not the ends. Before sending, compare the full address against a source you trust that is not your history: the exchange's deposit page, a message from the recipient you verified, a saved contact in your wallet. Compare the middle characters, because the ends are what the scammer matched.

Check the address on KadenaTrace. Check an address tells you whether an address is linked to a known theft or scam report. It would not have caught KT-20's poisoned address before the first victim, because the address was new; it will catch it for the next person. The check is also available as a free API for wallets.

Other habits that help:

  • Use your wallet's address book for anything you send to more than once, and send to the contact, not to a pasted string.
  • Send a small test amount first for a new destination, then the rest. The cost is one extra fee.
  • Treat unexpected tiny deposits as a sign that someone is preparing this. They cost the scammer almost nothing; the one copy mistake pays for thousands of them.

What to do if it already happened

The transfer cannot be reversed. Follow the first hour after a theft: trace the receiving address, report to any exchange it reaches, file a police report, and register the case so the funds are watched. In KT-20 the funds were swapped within two days; the window was short.

What this guide does not claim

The two addresses in KT-20 are shown as named by the source: one as the victim's intended destination, one as the poisoned look-alike. KadenaTrace does not say who controls either. The dollar figures are as reported and as traced on October 31, 2026; the case page has the current state.

More guides