This afternoon my Ethereum address monitoring suddenly fired off alerts: two outgoing transactions I never made. I was stunned — I hadn’t done anything, it wasn’t me. Was my wallet stolen? I rushed to check what those transactions actually did. After asking around I learned this is an “address poisoning” attack, and I’m sharing what I learned so everyone can stay alert.
What happened
Two monitoring alerts for my Ethereum address arrived in the afternoon. To keep the story clear, I’ll walk through just one of the transactions. One of them, 0x8c1c96f54cd2d2173bb54f2076f380740519643c49711bd4a85903c1038d64d6, showed:
- From: 0x014523f2A626F0E3dBc241B8e9A4C14c507a6360
- Executed contract: 0x72E64894db7143C096240D023BCf8855b73715e0
- ERC-20 token transfer: from renfei.eth to 0x205EB391A7A6B8747b893c67355845F77093b8F1, for 10 ERC-20: USDC (USDC)
My account did indeed show that I had sent 10 USDC to 0x205EB391A7A6B8747b893c67355845F77093b8F1. I was baffled — those two 10-USDC transfers shouldn’t even have succeeded, because my balance didn’t have 20 USDC in it?
Clicking the token: 0x96a4a852002fda2478b9dde6ba83485bd4efdac4, calling itself USDC — but without the green checkmark next to the name — it showed my balance as 460,282.2 USDC. Huh? Since when do I have that much money?
Analyzing the attack
Before these two transactions, I had made one real transfer of my own, also 10 USDC, to 0x205E94337bC61657b4b698046c3c2c5C1d2Fb8F1. Remember that real address, then look at the two fake ones:
- Recipient 0x205EB391A7A6B8747b893c67355845F77093b8F1 for 10 ERC-20: USDC (USDC)
- Recipient 0x205E6815c2A51475E687124Efb77f0f1EE73b8f1 for 10 ERC-20: USD Coin (USDC)
See it? They all start with 0x205E and end with b8F1. The hacker crafted two fake transactions that look almost identical to the real one. We know addresses are usually displayed showing only the beginning and the end — the hacker is betting that next time you send money, you’ll copy the address straight from your transfer history. And then your money lands in the hacker’s wallet.
How it works
A real transfer requires a private key signature, but the event logs inside smart contract code can be written freely. So the hacker built their own fake token and fake contract, and the contract code simply does: emit Transfer(fakeFrom, fakeTo, fakeValue);. That log is permanently recorded on chain, and block explorers (Etherscan) render it in the Token Transfers section per the ERC-20 standard — looking exactly like a real transfer.
And how do the fake addresses end up resembling the real ones so closely? An Ethereum wallet can generate infinitely many addresses. You just keep generating until one matches the desired prefix and suffix.
For example, I once used a GPU to generate countless wallet addresses and picked one I liked: 0x000000000000dD757d6566a60534a3B9c3D98F79 — that’s also one of my wallet addresses. With enough brute-force speed, finding a matching address doesn’t take long.
How to defend yourself
- If the signature isn’t yours, it’s most likely fake. There are cases of contract approvals, but you can just check your approvals on revoke.cash.
- Ignore unfamiliar tokens. Don’t try to move them out, and don’t go asking strangers online for “solutions” and believing them.
- When making a transaction, never copy the address from your history — initiate it from wherever you intend to send, ideally using an ENS name.
- At no point should you ever enter your seed phrase or private key.
- This kind of “forged log” is a visual scam — it cannot directly steal your coins.