A new research paper published July 27 on arXiv has quantified the scale of address-poisoning attacks across major Ethereum Virtual Machine chains. The study identified nearly 1.4 billion state-invariant transactions — transfers that don't change the net balance of a wallet — across Ethereum, Optimism, and Base. On Ethereum alone, 53% of non-reverted state-invariant transactions were linked to address-poisoning campaigns. The attack doesn't compromise private keys. Instead, it exploits a simple human habit: copying and pasting addresses from transaction history.
How the attack works
Address poisoning is a social-infrastructure attack. Attackers generate vanity addresses that share the same first and last characters as a real counterparty. They then inject those lookalike addresses into a victim's transaction history via dust or zero-value transfers. The sequence is straightforward: recon — find a target wallet that recently paid a known counterparty; forge — generate a vanity address with matching visible edges; plant — send a tiny or zero-value transaction to the victim; wait — until the user copies the lookalike address from their history; catch — the funds go to the attacker. Most wallet interfaces abbreviate addresses — e.g., 0x12ab...9881 — and users recognize patterns by matching the first and last characters. That's exactly what the attack exploits.
Why it's growing
The attack is particularly prevalent on networks with cheap gas and fast transactions. Base, after the early-2026 memecoin flurries, became a hotbed for these campaigns. Low fees make it cheap to send thousands of dust transactions. The arXiv paper's data covers Ethereum, Optimism, and Base, but the technique works on any chain where users copy-paste addresses. Address poisoning evolved from earlier 'dusting' attacks that aimed to deanonymize wallets. Now dust is the delivery mechanism for lookalike addresses.
What's being done
Binance Academy updated its guidance in July 2026 to highlight how attackers craft lookalike addresses and plant them via tiny or zero-value transfers. The update warns users to verify the full address, not just the first and last characters. No major wallet interface has announced a redesign to address the truncation problem, though the paper's findings may push developers to reconsider how addresses are displayed. For now, the burden remains on users.
The scale of the problem
The 1.4 billion figure is staggering, but not all those transactions are malicious. The paper classified state-invariant transactions as those where the sender and receiver addresses are identical in structure but not necessarily part of an attack. Still, 53% on Ethereum being linked to poisoning campaigns suggests a systemic issue. The attack is cheap to execute and hard to trace. The next concrete step? Wallet providers will likely face pressure to show full addresses by default, or at least flag transactions from addresses that closely match a user's recent contacts. No timeline has been set.
