How the scam works
- A bot watches the chain for addresses that send or receive stablecoins regularly.
- It generates an address that starts and ends with the same characters as one you use, such as your own wallet or a deposit address you often send to.
- It sends you a tiny amount, or a zero-value token transfer, from that lookalike address. Now it sits in your transaction history, right next to the real one.
- The next time you copy an address from your history instead of from its source, you may pick the fake. The transfer is final.
Wallets and block explorers often shorten addresses to their first and last few characters, like TQx7…9fK2. That shortened form is exactly what the scammer imitates.
Where it happens
It's most common with USDT on TRON and Ethereum: stablecoin users send often and in large amounts, and fake token transfers cost almost nothing. On Ethereum-style networks, zero-value transfers and fake tokens can even make an entry look as if it came from your own address. It happens on Bitcoin and other chains too, as tiny “dust” payments.
Habits that stop it
- Copy the address from its source, every time. For your own wallet, its Receive screen. For an exchange deposit, the exchange's deposit page. For a swap, the deposit address on your order page. Never from transaction history.
- Compare more than the ends. Check some characters in the middle too. Lookalikes match the first and last few characters because that's all most people check.
- Use your wallet's address book for addresses you send to repeatedly, and label them.
- Ignore tiny transfers you didn't expect. Don't interact with them, and don't send anything back.
- Send a small test first for a new or large transfer, and confirm it arrived where you meant.
- Watch your clipboard. Some malware replaces a copied address with the attacker's. After pasting, check the address against its source again.
Use fresh addresses
Poisoning targets addresses with visible, repeated activity. A fresh receive address for each swap gives a scammer less to imitate and keeps your swaps from being linked to each other. Monero makes this easy with subaddresses, and most Bitcoin wallets create a new address in one tap. On TRON and Ethereum you can still keep separate addresses for separate purposes.
What Lethe checks, and what it can't
Every address you enter on Lethe is checked with its network's checksum before an order opens, so typos and wrong networks are caught. When the exchange opens your trade, Lethe also checks that the receiving address in its reply is exactly the one you entered.
What no site can check is whether an address is really yours. A poisoned address is a perfectly valid address; it just belongs to someone else. That last check is yours: compare the receiving address in the console, and later on the order page, with your wallet's Receive screen.
The Paste and Scan QR code buttons in every address field help, because they take the address straight from your clipboard or your wallet's QR code. The scan happens in your browser, and the image never leaves your device.
If it already happened
Blockchain transfers can't be reversed. If you sent to a poisoned address, save the transaction ID and the scammer's address and report it to the platforms involved. If the funds were USDT, Tether can freeze tokens at an address, usually at the request of law enforcement. Be wary of anyone who offers to recover the funds for a fee: recovery offers are a common second scam.
Then change the habits that let it happen: fresh addresses, an address book, and copying from the source. Swapping stablecoins? Read about the USDT networks too.
