Zero-Value Phishing: Address Poisoning Without Tokens

Zero-Value Transfer Phishing: The Address Poisoning Variant That Moves No Tokens

• The user interfaces of modern cryptocurrency wallets are designed around a single, highly logical principle: convenience. To help users navigate the landscape of long, complex, 42-character hexadecimal public addresses, wallet developers have optimized their layouts. They shorten these confusing strings of letters and numbers, displaying only the first few and last few characters of an address in the user's transaction history.

This UI choice solved a major design friction point, but it also introduced a massive cognitive vulnerability.

• Because humans are creatures of habit, almost every active Web3 participant has adopted a highly dangerous shortcut. When sending a recurring transaction to a friend, an exchange deposit address, or a personal cold storage account, they do not manually type out or verify all 42 characters. Instead, they navigate to their recent transaction history, find a past transfer to that contact, copy the destination address, and paste it into the sending interface.

Cybercriminals have systematically turned this habit into one of the most widespread, highly automated drainer mechanics in Web3: Zero-Value Transfer Phishing, commonly known as Address Poisoning.

• Unlike standard phishing attacks that require a compromised private key or a malicious smart contract signature, address poisoning does not require you to connect your wallet to a sketchy website or sign a suspicious permit message. The attack occurs entirely on-chain, utilizing the core mechanics of the ERC-20 token standard to "poison" your transaction history with a phantom address that looks almost identical to your most trusted contacts.

• To understand why address poisoning is so highly effective, we must first look at how humans process complex cryptographic data. A standard Ethereum Virtual Machine (EVM) address is a raw, non-checksummed hexadecimal string of 40 characters, prefixed by "0x" to denote its format. It looks like this:

0x71C5656123456789ABCDEF0123456789ABCDEF67

To a human brain, this string holds no native semantic meaning. It contains no recognizable words, phonetic structures, or logical patterns.

• Faced with this cognitive wall, our brains naturally search for shortcuts. We look at the first four to six characters after the prefix to orient ourselves, and then we verify the final four to six characters to confirm we have the right destination. If we see 0x71C5...EF67 on our screen, we immediately assume the entire middle portion of the address is correct.

• This shortcuts-first habit is the exact psychological gap exploited by address poisoning. Scammers generate millions of dummy addresses until they find one that perfectly matches the prefix and suffix of your target contact.

• By injecting this look-alike address directly into your transaction history, they set an invisible trap. The next time you perform a routine copy-paste operation from your recent history, you copy the attacker's spoofed address instead of your legitimate destination.

2. What is a Zero-Value Transfer Attack?

The most elegant and terrifying aspect of this exploit is that the attacker does not need your permission to write transactions onto your ledger. They exploit a specific implementation detail within the standardized code of most ERC-20 tokens: the zero-value transfer allowance.

In the standard ERC-20 token specification, smart contracts define how tokens are transferred between accounts. The two primary functions used to move tokens are:

• transfer(to, value): Moves a specific quantity of tokens from the caller's address to the recipient's address.

• transferFrom(from, to, value): Allows a third-party contract or address to move tokens on your behalf, provided you have previously granted them a spending allowance.

Under normal operating conditions, if an address attempts to call transferFrom to move tokens out of your wallet without your permission, the transaction will instantly revert with an "Insufficient Allowance" error.

• However, many major token implementations (including prominent stablecoins like USDT and USDC) do not enforce allowance checks if the value parameter is set to exactly 0.

• Because transferring zero tokens does not change any balances, the smart contract allows the transaction to execute successfully without requiring any cryptographic signatures or spending approvals from your account.

The transaction is mined on-chain, gas is paid by the attacker, and the contract emits a standard Transfer event.

This event log declares to the network that a transfer of zero tokens has occurred from your address to a designated target.

3. The Vanity Address Generator: Creating the Illusion

• To make the zero-value transfer look convincing, the attacker must generate a look-alike address that mimics one of your primary contacts. They accomplish this using specialized, GPU-accelerated software known as a vanity address generator.

Using arrays of high-performance graphics cards, attackers run high-speed mathematical checks to mine public keys.

• They define a target prefix and suffix (for example, matching the first six characters and the last six characters of your personal exchange deposit address) and let the GPUs run until they hit a match.

• Because the difficulty of mining a vanity address scales exponentially with the number of characters being matched, matching an entire 40-character hash is practically impossible.

However, matching just the outer sequences is incredibly fast and cheap.

• Within a few seconds, a high-power GPU cluster can generate an address that starts with 0x71C5 and ends with EF67, while leaving the middle 28 characters completely different.

To a user scanning their recent transaction logs on a mobile wallet, the spoofed address looks absolutely identical to their genuine account.

4. Table 1: Anatomy of a Spoofed Address

To clearly illustrate how subtle the differences between a legitimate address and a poisoned vanity address are, consider this comparison of their structural elements:

Address Type	Address Visual Layout
Legitimate Contact	Starts with matching outer sequence; middle characters are completely unique.
Poisoned Copy	Mimics exact outer sequence; uses randomized internal characters.

5. Step-by-Step Execution of an Address Poisoning Campaign

Address poisoning is a highly automated, industrialized operation. Attackers do not target individual retail wallets by hand; they deploy high-speed monitoring scripts that scan public block explorers and the mempools of major blockchains in real-time.

Here is how a typical campaign unfolds:

Step 1: Passive Surveillance

• The attacker's automated script monitors the transaction flows of high-volume tokens (especially stablecoins like USDT and USDC) on cheap, high-throughput networks like Polygon, BNB Chain, Arbitrum, and Base.

• They look for active wallets that regularly execute transfers of large sums to the same destination addresses (such as a user moving funds from their personal hot wallet to a Binance or Coinbase deposit account).

Step 2: Rapid Vanity Address Mining

The moment the script identifies a target wallet and its frequent destination contact, it extracts the outer characters of the contact's address.

It feeds these characters into a local vanity mining engine, generating a spoofed address that matches the prefix and suffix of the contact within seconds.

Step 3: Triggering the Zero-Value Log

The attacker’s contract calls the token's smart contract, executing a transferFrom call with the parameters set to:

• From: The victim's address.

• To: The newly mined, spoofed vanity address.

• Value: Exactly 0.

Because the value is zero, the transaction bypasses the standard signature check, executes on the blockchain, and records a transfer event in the public ledger.

Step 4: The Visual Poisoning

The victim opens their mobile wallet or checks their history on a block explorer to initiate a new transfer.

Because wallets parse the public ledger's Transfer events to display recent transactions, the victim's UI updates.

It now shows a recent transfer of 0 tokens to an address that starts and ends with the exact characters they expect to see.

Step 5: The Accidental Liquidation

The victim needs to make their next real token transfer.

• Instead of copying the address from a secure address book or digging up their original deposit link, they click on the very top transaction in their history, copy the destination address (which is actually the attacker's vanity wallet), and paste it into their transfer window.

• They authorize the transaction, send their real tokens, and the assets are instantly routed directly to the attacker's secure wallet with zero chance of recovery.

6. EVM-Level Mechanics of Zero-Value Logs

• To understand why this exploit has successfully run rampant across major blockchains, we must look at how the EVM processes event logs and how wallets display this data in their user interfaces.

When a smart contract executes, it can write structured messages called logs directly into the transaction receipt.

• These logs are compiled into a specialized state tree inside the blockchain, allowing external applications (like indexers and wallets) to easily read and display transaction activity without scanning the entire global state of the network.

For an ERC-20 token, a transfer event is structured as follows:

event Transfer(address indexed from, address indexed to, uint256 value)

The indexed keyword tells the EVM to store these specific parameters in a highly searchable format called topics.

• When a wallet app loads your transaction history, it does not calculate your balance by crawling every block. It simply queries an indexer (such as Etherscan or Alchemy) for any Transfer logs where your address matches either Topic 1 (from) or Topic 2 (to).

• Because the zero-value transaction successfully emits a valid Transfer log with your address listed in the from topic, the indexer records it as a real transaction belonging to your wallet history.

• When your mobile wallet queries the indexer, it receives this log and displays it as a recent outgoing transaction, formatting it with the shortened, user-friendly layout.

The EVM did exactly what it was programmed to do, and the indexer reported the truth—but the resulting UI display creates a dangerous illusion.

7. Table 2: Real vs. Spoofed Transaction Logs

Understanding the core differences in how actual transactions and zero-value spoof transactions manifest on the ledger is key to identifying an ongoing poisoning attempt:

Log Type	Transaction Value
Real Asset Transfer	Carries a positive integer representing real token quantity.
Zero-Value Spoof	Registers exactly zero; incurs nominal gas paid by attacker.

8. Real-World Case Studies: The Cost of a Misplaced Click

• The real-world scale of address poisoning is massive. Because the cost of executing zero-value transfers is extremely low on modern, high-throughput Layer 2 networks (often costing less than a cent in gas per transaction), attackers can run these poisoning campaigns continuously, targeting millions of wallets daily.

In mid-2023, a high-profile cryptocurrency whale fell victim to a highly targeted address poisoning campaign on the Ethereum network.

• The victim was a regular DeFi operator who frequently moved large tranches of stablecoins from their primary wallet to a secondary cold-storage address.

• The attacker’s automated system noticed this pattern, mined a vanity address matching the outer twelve characters of the cold-storage wallet, and executed a zero-value transfer.

The next day, the whale initiated a transfer of $20 million in USDT.

Hurrying through their standard routine, they opened their recent transaction logs, copied the top address, and authorized the transfer.

Because they copied the poisoned vanity address, the $20 million was routed directly to the attacker.

• Despite frantic efforts to contact stablecoin issuers and coordinate a rescue, the funds were systematically split and laundered through decentralized cross-chain mixers, making recovery impossible.

This is not an isolated incident.

• Security telemetry reports indicate that address poisoning campaigns account for tens of millions of dollars in losses annually, driven by the sheer scale of the automated campaigns running on low-gas networks.

9. Active Defenses: Securing Your Wallet from Phantom Logs

• Because address poisoning occurs entirely on-chain without requiring your signature or interaction, you cannot prevent attackers from sending zero-value transfers to your address.

However, you can make yourself completely immune to the attack by changing how you manage your destination addresses.

To protect your assets from these phantom transactions, implement these key defensive measures:

The Address Book Rule

Never, under any circumstances, copy a destination address directly from your transaction history.

• If you frequently send funds to the same accounts, use your wallet's integrated address book feature (available in wallets like Rabby and MetaMask) to save those addresses under custom, verified names.

When executing a transfer, select the contact directly from your saved list.

Double-Check the Middle Characters

If you must copy an address from a past transaction, do not rely on the prefix and suffix.

Manually verify the characters in the middle of the address string.

Checking even three or four characters in the center of the address is enough to instantly spot a poisoned vanity address, as attackers cannot match the internal characters of the hash.

Utilize Small Test Transactions

When moving substantial sums of capital to a new or infrequently used address, always execute a small, low-value test transaction first.

Verify that the test transfer arrives successfully at the correct destination before sending the remaining balance.

Once the destination is confirmed, save the address to your address book immediately to avoid copy-pasting it again in the future.

Leverage Web3 Domains and Aliases

Using decentralized domain systems like ENS (Ethereum Name Service) or Lens can significantly reduce the risk of copy-paste errors.

Sending funds to a human-readable domain name (such as alice.eth) is much easier to verify than scanning raw hexadecimal strings.

However, make sure to double-check that the domain hasn't expired and resolve it through a trusted provider before sending large sums.

10. Verification and On-Chain Telemetry via DEXTools

• In the modern, high-velocity Web3 environment, maintaining active visibility over your transactions and liquidity pools is essential. When you are trading trending altcoins or participating in newly deployed decentralized finance pools, copy-pasting addresses from raw chat logs, social media posts, or transaction histories exposes you to extreme front-running and address poisoning risks.

• DEXTools provides the critical, real-time analytical telemetry needed to verify the authenticity of any token or liquidity pool before you authorize a transfer. By entering a target asset's contract address directly into the advanced DEXTools Pair Explorer, you can instantly cross-examine its on-chain data:

• Verified Contract Audits: Instantly check if the token's smart contract is verified and review automated safety scores that flag hidden transfer restrictions or malicious minting backdoors.

• Live Transaction Velocity: Monitor the active buy and sell orders executing on the pool in real-time. If a token has zero organic transaction history or exhibits highly structured, artificial bot patterns, it may be a honeypot scam.

• Liquidity Pool Analytics: Verify the exact depth and lock-status of the underlying liquidity pools. Ensuring that the liquidity is locked prevents developers from executing rug pull scams after you buy.

Using this look-through telemetry allows you to navigate the decentralized space with absolute confidence, protecting your hard-earned digital assets from both front-end phishing campaigns and on-chain poisoning traps. 

You can access DEXTools here and start trading today!

Crypto Is in Extreme Fear While New Tokens Pump 100%. Live Data Shows How Few Last a Week Crypto Is Minting More Than 40,000 New Tokens a Day, and Most Have Almost No Liquidity What Is ENS: Ethereum Name Service, Wallet Names and Web3 Identity (2026) How to Use BscScan: Track BNB Chain Transactions, Tokens and Contracts (2026)