Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

Address poisoning: the lookalike address trick

Last reviewed: October 2026

TL;DR

Address poisoning plants a lookalike address in your transaction history, hoping you’ll copy it later. It beats anyone who checks only the first and last few characters. Never copy an address from your history or a block explorer, take a fresh address from Sparrow and check it on a device, and compare every character before you sign.

Bitcoin addresses are long and look random, so most people check the start and the end and trust the middle. Address poisoning is built around exactly that habit. It doesn’t hack anything. It waits for you to copy the wrong thing.

How the trick works

  1. The attacker watches the blockchain for an address you send to or receive from, such as your exchange deposit address or one of your own.
  2. With a lot of computing power, they generate an address of their own that starts and ends with the same characters. The middle is different.
  3. They send a tiny amount from or to that lookalike, so it shows up next to your real transactions in your wallet history or on a block explorer.
  4. Weeks later you need that address again, copy it from your history, glance at the first and last characters, and send. The coins go to the attacker.

It’s not rare. A study presented at USENIX Security 2025 counted 270 million poisoning attempts against 17 million victims in two years, with at least $83.8 million lost. In the best-known case, described by Chainalysis, a victim sent about $68 million in wrapped bitcoin on May 3, 2024 to an address that matched the real one in its first six characters, minutes after a successful test payment to the right one.

Those numbers come from Ethereum and similar networks, where wallets show a neat list of who you paid. I haven’t found a documented bitcoin loss on that scale. The trick works the same way on bitcoin, though: anyone can send a few sats to any address, and every block explorer shows them next to your real payments.

Why checking the start and the end fails

Matching a handful of characters at both ends is exactly what attackers pay computing power for. Matching the whole address is impossible. So the only check that beats the trick is the one people skip: every character, or at least long chunks in the middle as well.

A test payment doesn’t save you either, as the case above shows: the test went to the right address and the big payment to the copied one. What protects you is where the address comes from.

Defenses in a multisig

  • Receiving: take a fresh address from the Receive tab in Sparrow every time, and check it on the BitBox02 or Ledger, which have your multisig registered (step 8). The Trezor is an extra check.
  • Never copy from history. Not from Sparrow’s transaction list, not from a block explorer, not from an exchange’s list of past withdrawals. An address that appears there could have been planted.
  • Sending: get the destination fresh from its source each time, such as the deposit page of your exchange or a message the recipient confirmed by phone. Retype it or scan a QR code.
  • Check the full address on the device screen before you confirm a signature, against that source. The device can’t know an address is a lookalike; it only shows what will be signed (how to send from a multisig).
  • Label addresses in Sparrow. Give every receive address and every payment a label (who and why). A transaction you never labeled stands out.
  • Don’t reuse addresses. A deposit address you use over and over is the address an attacker will copy. Fresh addresses leave them nothing to imitate (moving bitcoin from an exchange covers the trade-off).

You received a tiny payment you don’t recognize

Unexpected dust, a few hundred or a few thousand sats, is either poisoning or an older trick: someone sends dust to an address you’ve used, hoping you’ll spend it together with your other coins so they can link them. In both cases the answer is the same.

  1. Don’t spend it and don’t send it back.
  2. Don’t copy any address from that transaction, ever.
  3. Freeze it in Sparrow. In the UTXOs tab, right-click the coin and choose Freeze UTXO. Sparrow then leaves it out when it picks coins for a payment. Sparrow also marks small coins that land on an address you already used as a possible dust attack, with a Freeze? link next to them.
  4. Give it a label such as “unknown dust, frozen” so you remember why it’s there.

The dust can’t do anything to your wallet by itself. Nobody can take coins out of a multisig by sending coins into it. The risk is only in what you do with it.

Note: the Freeze UTXO option and the dust warning are from Sparrow’s own source code, checked October 10, 2026. I haven’t had a dust attack on my own wallet to try them on.

Related: the clipboard version

Clipboard malware does the same thing faster: it swaps an address between copy and paste. The defense overlaps: check the address on the device screen against its source, every character. See receive address doesn’t match the device screen.

Common mistakes

  • Comparing only the first and last four characters.
  • Reusing an old address because it’s in your history and “worked last time”.
  • Thinking a successful test payment proves the next payment is safe.
  • Spending dust together with your real coins.

Related