If you accept crypto, your receiving address is public. Sooner or later you will see tiny transfers in your wallet history, a few cents or even zero, from addresses that look almost exactly like ones you have used. That is usually address poisoning. The scammer is not trying to take anything from your wallet right now. They are planting a lookalike address in your history and hoping you copy it the next time you send money.
Table of Contents
It costs them almost nothing, and it only has to work once. Here is how it works and the habits that make it fail.
How address poisoning works
- The scammer watches the chain for addresses that receive regular stablecoin payments. A store address is a perfect target: steady incoming transfers, and every so often a large outgoing one when the owner moves funds to an exchange or a cold wallet.
- They generate an address whose first and last characters match an address you actually deal with. Wallets and explorers often shorten addresses to something like
0x5056...ab6a, so the middle is hidden anyway. - They send you a tiny amount from that lookalike, or a fake token transfer that shows up in your history with a familiar name.
- Weeks later you need to send money to your exchange. You open your history, see the familiar
0x5056...ab6a, copy it, and send. The money goes to the scammer. A blockchain transfer cannot be reversed.
Nothing in your wallet was hacked. The only thing the attack needs is for you to copy an address from your history.
Why store wallets are a bigger address poisoning target
A personal wallet might send money out a few times a year. A store wallet receives many small payments and is periodically emptied. That pattern is easy to spot from outside, and the outgoing transfers are large. So a store wallet gets more address poisoning attempts than an ordinary one, and a mistake costs more.
It also makes a mess of your history. If you are trying to reconcile orders by scrolling through incoming transfers, a dozen fake entries make the job slower and easier to get wrong.
What StayCrypto does with dust
By default, StayCrypto treats anything under $0.10 as dust. Transfers below that, once two independent nodes confirm them, are skipped silently. They do not appear on the Unassigned payments page, they do not land on orders, and they do not trigger an alert for each one. The plugin writes a line to its log and sends you at most one Telegram summary a day per network.
The threshold is tied to the minimum order: the smallest order the method accepts is $1, and dust is one tenth of that. A real customer payment is never that small.
That keeps your admin clean. It cannot stop address poisoning transfers from appearing in your wallet app, because those are on the public chain. The habits below are what protect you there.
5 proven habits that defeat address poisoning
1. Never copy an address from transaction history. Not from your wallet’s history, not from an explorer, not from an old email. Take the address from its source: the deposit page of your exchange, the receive screen of your own wallet, or your saved address book.
2. Use an address book or whitelist. Most wallets let you save named addresses. Most exchanges let you whitelist withdrawal addresses, often with a waiting period for new ones. Set them up once with addresses you checked carefully, then send only to saved entries.
3. Check the whole address, not just the ends. Lookalikes are built to match the first and last few characters. Compare the middle as well. If your wallet shortens addresses, open the full view.
4. Send a test amount first for large transfers. A small first transfer to a new or rarely used destination, confirmed at the other end, costs one network fee. Skipping it can cost the whole balance.
5. Keep the store address separate. Use a dedicated address only for store payments (why one address per store matters), ideally on a hardware wallet, and move funds out to an address you control on a schedule. The plugin’s own wallet recommendations say the same. A separate address keeps your history short and readable, and a mistake on your personal wallet does not touch store funds.
The same rule applies to your plugin settings
The address in the StayCrypto settings is where every customer payment goes. If a poisoned address ends up there, every payment after that goes to a stranger.
So treat the settings field the same way: paste the address from your wallet’s receive screen, check it in full, then save. A few protections help:
- Only a site administrator can change the wallet addresses. Shop managers cannot.
- The plugin checks the address format, rejects the zero address, and on EVM networks validates the checksum (the mix of upper and lower case letters), which catches most typos.
- Changing an address shows a warning, writes to the log and, if Telegram is set up, sends you a message. If you get that message and did not change anything, act at once.
One more thing to know: the plugin watches only the current address. If you change it while customers have payment pages open, their pages pick up the new address, but anything already sent to the old address is not searched for. Check the old address in the explorer yourself.
If you think address poisoning got you
If you only received dust, nothing has happened yet. You do not need to do anything with it, and you should not interact with any token you do not recognise. Just make sure your address book is clean.
If you have already sent funds to a lookalike, the transfer is final. Report it to the exchange or wallet involved (sometimes exchanges can freeze funds that reach accounts they control) and keep the transaction link. Do not trust anyone who contacts you offering to “recover” it for a fee; that is usually the next scam.
For the wider picture on keeping the store wallet safe, read crypto wallet security for an online store.
FAQ
Can someone steal from my wallet by sending dust?
No. Receiving tokens does not give anyone access to your wallet. The danger is only in what you do next, such as copying the wrong address or interacting with an unknown token.
Why did I receive a “0 USDT” transfer?
That is a common form of poisoning. Some token contracts let a third party create a zero-value transfer that shows up in your history. It is bait, not a payment.
Will StayCrypto show these transfers on orders?
No. Transfers under $0.10, confirmed by two nodes, are skipped and never reach orders or the Unassigned list.
Should I change my store address if it is being targeted?
Not necessarily. Poisoning does not compromise the address. Changing it often creates more risk (old pages, customers with saved addresses) than it removes. Clean habits matter more.
Does a hardware wallet prevent address poisoning?
It protects your keys. It does not stop you from sending to the wrong address. The address still has to be checked on the device screen before you confirm.