Bitcoin Address Spoofing Attacks and Bitcoin Address Poisoning Mass Attacks: Massive Losses and New Cybersecurity Challenges in 2023–2025.

Jameson Lopp, chief security officer at Bitcoin storage company Casa, warns of a serious threat: Bitcoin address poisoning attacks. This social engineering scam uses crypto addresses that look like addresses in the victim’s transaction history to trick the user into sending funds to the scammer 2 3 .

The attack involves attackers creating Bitcoin addresses that match the first and last characters of addresses from a user’s transaction history. They then send small transactions from these malicious addresses to the victim’s wallet, “poisoning” their transaction history. When the owner copies an address from their history, they may accidentally transfer to a fraudulent address that mimics a wallet they frequently use 1 2 3 .

Lopp’s analysis of the blockchain data showed that such attacks were first detected on July 7, 2023 (block 797570) with 36 suspicious transactions. There was then a lull until December 12, 2023 (block 819455), after which there were regular spikes in attacks until January 28, 2025 (block 881172). After a two-month hiatus, the attacks resumed. In total, about 48,000 transactions matching the 2 10 address poisoning profile were detected over 18 months .

Bitcoin Address Spoofing Attacks and Bitcoin Address Poisoning Mass Attacks: Massive Losses and New Cybersecurity Challenges in 2023–2025.

Lopp cites specific cases: one user lost 0.1 BTC in the first attack, and 12 hours later sent the same amount again to the correct address, which indicates the confusion of the victims. In another case, the victim’s wallet contained 8 BTC, which could have led to significant losses 1 3 .

The main factor contributing to the growth of such attacks is the low transaction fees on the Bitcoin network, which have been in place since July 2024, allowing attackers to conduct fake transfers en masse and at almost no cost, thereby increasing the chances of successful fraud. Lopp believes that increasing fees could significantly reduce the frequency of such manipulations. The specialist also calls on cryptocurrency wallet developers to create improved user interfaces that fully display addresses and implement an automatic warning system for suspicious addresses when sending funds 1 3 6 .

In March 2025, cybersecurity firm Cyvers recorded over $1.2 million in stolen funds through address poisoning attacks, and in February, the damage was estimated at $1.8 million, according to its CEO Deddy Lavid. This is only a small part of the scale of security problems in the crypto industry 2 .

Additionally, PeckShield estimates total losses from crypto hacks in Q1 2025 at over $1.6 billion. In February of that year, the hack of the largest crypto exchange Bybit resulted in losses of $1.4 billion, making it the largest hacking incident in crypto history 2 .

Experts have linked the hack to the North Korean group Lazarus Group, which is known for sophisticated social engineering schemes, including fraudulent job offers, fake Zoom meetings with venture capitalists, and social media phishing attacks. These methods are aimed at stealing cryptocurrency and sensitive data 2 .

Jameson Lopp’s warning is therefore an important signal that Bitcoin owners need to pay more attention to verifying addresses before sending funds and implementing more robust security solutions in crypto wallets to combat new forms of fraud.

Key facts:

From July 2023 to January 2025, approximately 48,000 Bitcoin address poisoning attacks were detected across blocks 797570–881172 2 .
The attack is based on the use of addresses similar to those from the victim’s transaction history, with the same first and last characters 2 3 .
Low fees on the Bitcoin network since July 2024 have facilitated the mass implementation of these attacks 1 3 6 .
Losses from such attacks in early 2025 exceed millions of dollars, and total crypto hacks are billions, including the largest hack of the Bybit exchange for 1.4 billion 2 .
Lazarus Group uses sophisticated social engineering techniques in such cybercrimes 2 .
It is recommended to implement warning systems in wallets and carefully check addresses during transfers 1 2 .

Let’s look at a selection of articles and sources that cover the topic of Bitcoin address poisoning attacks and related scams in detail:

Casa security expert Jameson Lopp details the types of address poisoning attacks, their statistics for 2023-2025, and provides recommendations for protecting users 1 .
A review of 48,000 documented cases of Bitcoin address spoofing attacks since July 2023, with examples and analysis of the reasons for the increase in attacks against the backdrop of low BTC network fees 2 .
Jameson Lopp’s analysis of “poisoned” addresses, which describes the attack mechanism, consequences, and suggestions for mitigating the threat in the form of wallet warnings 3 .
A brief description of the mechanics of the address poisoning scam – small transactions are sent from addresses similar to those used by the user in order to confuse him 4 .
Binance.com Analytics: Cyvers Alerts Data on a Sharp Rise in Address Spoofing Attacks in March 2025 and Recommendations to Improve Security with AI and Address Whitelisting 5 .
Major case on Coindesk.com: example of a major theft of $68 million in cryptocurrency via an address poisoning attack, details of the method and comments from CertiK experts 6 .
An overview of the crypto dust attack variant, with a description of the relationship with address poisoning methods and explanations of technical details on Bits.media 7 .

Jameson Lopp, a security expert and co-founder of Casa, has detailed the mechanics and scale of Bitcoin address poisoning attacks that will be active in 2023–2025. These attacks are based on social engineering and involve substituting crypto addresses — attackers create addresses similar to those in the victim’s transaction history, matching the first and last characters. The malicious addresses “poison” the victim’s transaction history by sending them small amounts in order to substitute the usual addresses for subsequent transfers 1 2 .

Lopp’s analysis showed that the first recorded poisoning transactions appeared in Bitcoin block 797570 (July 7, 2023) with 36 suspicious transactions. After a temporary hiatus from December 2023 to January 2025, such attacks occurred regularly, then there was a two-month break before the attacks resumed. Over 18 months, about 48,000 transactions were detected that matched the poisoning profile of addresses 1 2 3 .

An example of the consequences of such attacks is the case when a user first sent 0.1 BTC to a fraudulent address, and 12 hours later transferred the same amount to the correct wallet. Moreover, 8 BTC were found in the victim’s wallet, which could have led to significant financial losses if the error had not been noticed in time 1 3 .

Lopp attributes the increase in attacks to a sharp drop in transaction fees on the Bitcoin network since July 2024. Low fees have made large-scale attacks virtually cost-free. The specialist points out that increasing fees could reduce the frequency of such frauds 1 3 .

To combat the threat, Lopp suggests that crypto wallet developers implement systems to automatically warn users when they try to send funds to suspicious addresses, as well as create interfaces that fully display addresses to prevent copying errors 1 2 3 .

These attacks pose a serious threat to the security of cryptocurrency users, requiring both increased awareness of the dangers and technological innovation to protect funds.

Jameson Lopp’s investigation and recommendations are therefore an important contribution to understanding and mitigating the risks associated with Bitcoin address poisoning, a scam that involves a high level of social engineering and technical sophistication 1 2 3 .

Jameson Lopp, a security expert and co-founder of Casa, has conducted an in-depth analysis of Bitcoin address spoofing attacks, which have received widespread attention in the crypto community since July 2023. During this period, there were approximately 48,000 cases of Bitcoin address poisoning attacks, a scam that relies on social engineering and the use of addresses that look like legitimate ones 1 .

Attack mechanism

Attackers create malicious Bitcoin addresses that match the first and last characters of addresses in the victim’s transaction history. They then conduct small transactions from these malicious addresses, “poisoning” the user’s transaction history. When a wallet owner copies an address from the list of recent transactions, they risk accidentally sending funds to the scammer, since the addresses look very similar 1 .

Examples and consequences

In one case, a user sent 0.1 BTC to a fraudulent address, and 12 hours later correctly transferred the same amount to the correct wallet. In another case, the victim had 8 BTC in the wallet, which could have led to huge losses if the criminals had exploited the error 1 .

Reasons for the increase in attacks

Lopp attributes the increase in such frauds to a sharp decrease in transaction fees on the Bitcoin network since July 2024. Low fees allow attackers to conduct small fake transfers en masse at virtually no cost, which significantly increases the chances of a successful attack 1 .

The extent of the damage

According to analysts, victims have sent more than $1.2 million to attackers through such scams since the beginning of March 2025 alone. This is just part of a larger picture, where crypto hacks and scams in the first quarter of 2025 resulted in losses of over a billion dollars, including the largest hack in history of crypto exchange Bybit, amounting to about $1.4 billion 1 2 .

Recommendations for protection

Jameson Lopp strongly recommends that Bitcoin owners:

Always double check the address when sending funds, especially if it is copied from your transaction history.
Crypto wallet developers should implement automatic warning systems when suspicious or visually similar addresses are detected.
Improve user interfaces to display the full address and reduce the risk of mistakenly sending funds to fraudsters 1 .

Thus, Bitcoin address spoofing attacks have become widespread over the past almost two years and have caused significant financial damage to users. The growth of these crimes is directly related to the network’s operating features and low fees, which highlights the need for technical and educational measures to improve the security of the crypto community.

An example of a successful Bitcoin address spoofing attack illustrates the main methods used by fraudsters in this type of fraud. The attackers create malicious Bitcoin addresses that match the first and last characters of addresses in the victim’s transaction history. They then send small amounts of money from these fake addresses to the victim’s wallet, “poisoning” their transaction history. This creates the illusion that the address is safe and frequently used by the victim.

As a result, when a user copies an address from their transaction history to send funds, they risk mistakenly transferring money to a fraudulent address, since it is visually very similar to the original. For example, one user sent 0.1 BTC to a fraudulent address, and 12 hours later transferred the same amount to the correct wallet, which clearly demonstrates how social engineering methods work to cause confusion and errors.

The key to this attack is manipulating the visual perception of addresses, using small transactions to create false trust. These methods are combined with the low fees of the Bitcoin network, which allows fraudsters to carry out such substitutions en masse at almost no cost.

To prevent such attacks, experts recommend carefully checking addresses when sending and implementing automatic warnings about suspicious addresses in crypto wallets, as well as showing addresses in full to minimize the risk of copying errors.

Thus, this example demonstrates that successful address spoofing uses a combination of technical tricks and social engineering to achieve its goals – stealing funds by leveraging the user’s trust in the “poisoned” transaction history 1 2 .

Bitcoin address poisoning scams are a type of social engineering attack in which attackers send users small transactions from addresses that are very similar to the ones the victim uses or sees in their transaction history. The goal of such an attack is to mislead the user so that they will copy and use the scammer’s fake address instead of the real one the next time they send cryptocurrency.

The basic mechanism of fraud is as follows:

Attackers generate Bitcoin addresses that match the first and last characters of addresses from the victim’s transaction history, creating a visual similarity and making it difficult to distinguish between a real and a fake address.
Fraudsters send small transactions from these malicious addresses to the victim’s address, “poisoning” the user’s transaction history.
When a user copies an address to make a transfer, they see a fake address, often visually indistinguishable from the real one, and may accidentally send funds to a fraudster.
The low fees on the Bitcoin network make such attacks widespread and cost-effective for attackers, as they can send out numerous small transactions at virtually no cost.

For example, one of the victims first sent 0.1 BTC to a fraudulent address, and 12 hours later correctly transferred the same amount to a genuine wallet. This clearly demonstrates how manipulation of visual perception of addresses works and causes errors in users.

To protect against such scams, security experts and specialists, including Casa’s Jameson Lopp, recommend:

Always check the sending address carefully, especially if it is copied from the transaction history.
Implement a full address display function into crypto wallets to reduce the risk of copying errors.
Use automatic warning systems for suspicious addresses based on algorithms and machine learning to identify fake addresses before a transaction occurs.
Take measures to raise user awareness of the nature and methods of such attacks.

Thus, Bitcoin address poisoning scams are technically and socially sophisticated schemes aimed at exploiting user trust and the peculiarities of the cryptocurrency address system to steal funds, which requires a comprehensive approach to minimize risks and protect assets.

Source of information: analysis of expert materials and reviews on the topic of attacks with poisoning of addresses in the Bitcoin network, including data from Casa, Cyvers, and specialized crypto-security publications 3 4 5 6 7 8 .

Bitcoin address spoofing attacks have increased sharply in March 2025, according to Cyvers Alerts analytics data published on the Binance.com platform. These attacks are a type of fraud in which attackers send out mass small transactions from addresses that are visually very similar to addresses in the victims’ transaction history. The goal of such an attack is to “poison” a user’s transaction history so that when they copy the address in the future, they accidentally send funds to a fraudulent wallet instead of the real one 6 .

Cyvers Alerts analytics showed that the number of such scams increased sharply starting in March 2025, with victims voluntarily transferring over $1.2 million to scammers in the first month alone. The increase in activity is explained by the fact that low fees on the Bitcoin network since July 2024 allow attackers to conduct mass small transfers at virtually no cost, making these attacks cost-effective and widespread 6 .

To improve the security of cryptocurrency users, analysts and experts recommend the implementation of modern technologies, in particular:

Using artificial intelligence (AI) systems that automatically analyze addresses when sending funds, identify suspicious matches and warn the user of potential risks;
Use of “whitelists” of reliable and verified addresses, which reduces the likelihood of errors and sending funds to malicious wallets;
Improving user interfaces of wallets with full display of addresses and improving visual and software tools for address verification before conducting transactions.

These recommendations are aimed at reducing financial losses and protecting users from the social engineering used in these attacks, which requires a comprehensive technological approach and increased community awareness.

Thus, the sharp increase in address spoofing attacks in March 2025 and the response using AI and address whitelisting reflect the dynamics of modern cyber threats in the crypto industry and highlight the importance of implementing advanced security measures to protect users’ assets.

A major cryptocurrency theft case involving around $68 million in cryptocurrency via an address poisoning attack was one of the notable digital asset security incidents that was covered in detail on Coindesk.com in May 2024. This case serves as a prime example of how Bitcoin address spoofing fraudulent methods can cause huge financial losses even for experienced users and investors.

The essence of the attack and the mechanism of address poisoning

An address poisoning attack is a clever social engineering technique in which an attacker creates a fake crypto address that is visually as similar as possible to the victim’s real address. In this particular case, the scammer forged the address by simulating a match between the first and last six characters of the victim’s main wallet, which can be up to 42 characters long. This substitution makes it difficult to visually identify the real address, especially when the victim copies the address from history or contacts to make a transfer.

Before the main theft, the attacker made a transaction with a small amount of 0.05 ether (ETH) to “poison” the user’s transaction history and create the illusion of a legitimate address. The user then mistakenly sent a large sum of 1,155 wrapped bitcoins (WBTC) to the fake address, resulting in the loss of approximately $68 million in cryptocurrency.

Incident confirmation and investigation

The case was confirmed by several reputable blockchain security companies, including Cyvers, XBT blockchain research company, and other cybersecurity specialists. The incident was analyzed in detail by experts, who noted the rise of address spoofing scams due to the ever-increasing popularity of cryptocurrencies and the lack of attention paid by users when checking addresses.

Context of the scale of cybercrime in the crypto industry

This major theft case is part of a general trend of increasing fraud and hacker attacks in the crypto space. Already in the first quarter of 2024, the amount of stolen funds through various schemes has deprived billions of dollars. For example, crypto investors lost over $2.5 billion in the first half of 2025 due to hacks and fraud, according to Certik, one of the leading companies in crypto security analysis.

The largest theft from the crypto exchange Bybit stands out in particular, where hackers stole about $1.4 billion using complex social engineering schemes and technical vulnerabilities. These facts highlight the seriousness of the threat to crypto assets around the world.

Recommendations and conclusions of experts

Certified Security (CertiK) experts and other analysts emphasize the importance of strengthening verification measures and raising user awareness to minimize the risks of such attacks. Among the recommended measures:

Carefully check the full crypto address before sending funds, with special attention to characters that can be surreptitiously changed by scammers.
Implementation of tools for automatic detection of suspicious addresses based on artificial intelligence and machine learning in crypto wallets and exchanges.
Use of whitelists of trusted addresses and multi-factor authentication systems for large transfers.
Improving the security of user interfaces – for example, implementing visual indicators that make it easier to distinguish fake addresses.

Conclusion

The $68 million case demonstrates that address poisoning attacks are an extremely dangerous and effective tool for cryptocurrency fraudsters. As the crypto industry continues to evolve, protecting users and their assets requires a comprehensive approach that includes not only technological solutions but also educational programs aimed at increasing digital hygiene and caution.

Sources:

Coindesk.com, May 2024: “Exploiter Steals $68M in Crypto via Address Poisoning”
CertiK Cryptocurrency Security Reports 2024–2025
Analytics of Cyvers, XBT and other cybersecurity platforms
Overall Data on Cyber Frauds and Hacks in the Crypto Industry, 2023–2025

How Big Cases Like These Affect Trust in the Cryptocurrency Industry

Major cases of fraud and hacking, such as the $68 million crypto address poisoning attack, significantly affect trust in the cryptocurrency industry, creating both negative and stimulating changes.

Decreased User and Investor Confidence
Large-scale thefts and losses of funds are causing concern among current and potential cryptocurrency market participants. Many perceive such incidents as confirmation that the crypto industry remains vulnerable to fraud and technical risks. This is especially true for less experienced users, who become afraid of losing their investments and become more cautious in using cryptocurrencies 5 .
Impact on the reputation of crypto projects and exchanges
Major hacks often lead to a loss of reputation for both exchanges and wallets, as well as project teams. This can be expressed in the departure of large investors, a drop in the price of tokens, and even the closure of affected companies. The example of the collapse of the FTX platform in 2022 showed that even leading players in the industry are not immune to trust losses, which slows down the development of the sector and requires new security standards 5 .
Strengthening control and regulation
Serious incidents prompt regulators to introduce stricter requirements for crypto businesses, which on the one hand increases user security, and on the other increases costs and formal barriers for crypto projects. This causes a mixed reaction in the community, since on the one hand it promotes the development of the industry, and on the other, it generates bureaucracy and limits innovation 1 5 .
Raising awareness and security
Such major cases become a lesson for the industry and users, spurring developers and security teams to implement more advanced security technologies, including artificial intelligence, automated alerts, address whitelists, and multi-factor authentication. The incidents demonstrate the need for a combination of technical measures and user vigilance 5 6 .
Supporting the Long-Term Development of the Industry
Despite the short-term decline in trust, some experts believe that by improving security standards and educating users, the crypto industry is laying the foundation for sustainable growth and greater integration with the traditional financial system. This takes time, but it will help to create a mature market with a higher level of trust 2 3 .

In this way, major thefts and frauds act as a catalyst for change – they reduce trust and create fear, but they also spur efforts to improve security and regulation, which over time can improve the overall level of security and stability in the cryptocurrency industry.

Sources:

Crypto Ecosystem and Regulation Analytics, BIS (2023) 1
Review of the Impact of the FTX Crash on the Cryptocurrency Industry, YB Case (2022) 5
Research of trust in the crypto market, BDC Consulting 2 3
Statistics of fines and security of crypto companies, TAdviser (2025) 6

Sources:

Cyvers Alerts analytics and Binance.com report on the rise of address spoofing attacks, March 2025 6 .
Additional data and comments on the scale and methods of attacks – ForkLog, Elitetrader, TAdviser (2025) 5 6 1 .

Sources:
1 ForkLog, “Jameson Lopp Discovers 48,000 Bitcoin Address ‘Poisonings’,” April 2025
2 TAdviser, “Cryptocurrency Fraud,” May 2025

Sources:
1 ForkLog: “Jameson Lopp Discovers 48,000 Bitcoin Address “Poisonings””
2 Block-Chain24: “Jameson Lopp Sounds the Alarm About Address Poisoning Attacks”
3 Moneytimes.ru: “More than 48,000 Bitcoin Addresses Poisoned”