How Address Poisoning Drains Crypto Funds Without Breaking Private Keys
Address poisoning is a scam that tampers with a user's transaction history instead of attacking private keys, convincing victims to send funds to a maliciously crafted lookalike address. Incidents including a roughly 3.5 wBTC theft from a Phantom Chat phishing campaign in February 2026 and a $50 million USDT loss in 2025 show how interface design and user habits can lead to large losses. By abusing dust transfers, copy buttons and truncated address displays, attackers exploit behavior and wallet UX to make poisoned addresses appear trustworthy.