Address Poisoning: The $0 Transfer in Your Swap History

On 7 November 2026 I pulled every USDT Transfer log from 20 consecutive Ethereum blocks (26,363,482–26,363,501). Of 2,346 logs, 587 carried a value of zero — 25.0% of the token's transfer traffic in roughly four minutes. Many arrived in batch transactions, but one was different: a zero-value transfer from 0x8c6ff6…91e1 to 0x8c6f58…91e1, two addresses that share their first four and last four hex characters. That is address poisoning. No private key was stolen, no contract was approved, no signature was requested. The attacker paid for one line in the recipient's history and bet that the next copy-paste picks the wrong address. (XMR to USDT exit)

How the trick is built. An attacker generates an address whose leading and trailing characters match a target. An EVM address is 20 bytes shown as 40 hex characters; fixing the first k and last k leaves the middle unconstrained. A vanity search needs about 16^(2k) attempts: 3+3 is 16.7 million, minutes on a laptop; 4+4 is 4.3 billion, feasible for a GPU rig but not free. The attacker then sends 0 USDT, or 0.000001, from the lookalike to the target, directly or through a batch contract. The transfer is valid, costs a little gas, and writes the attacker's address into the target's history. Wallets and explorers show only a few leading and trailing characters, so the fake looks right at a glance. (XMR to USDT exit)

What the measurement does and does not say. In a second 20-block window the zero share was 14.6% (333 of 2,287 logs); a parallel USDC window showed 19.0% (311 of 1,638). The rate moves with spam waves. Zero-value transfers are cheap noise: a single batch transaction in the first window emitted 116 zero-value Transfer logs across four token contracts, paying 1,767,530 gas at 46.5 gwei. That is 0.0000822 ETH, about $0.18 at ETH $2,243 (14:10 UTC), or roughly $0.0016 per log. Many zero transfers are airdrop junk or indexer tricks. The poisoning signal is the address pair, not the amount.

Why this looks like an Ethereum pattern. On TRON, 60 consecutive blocks (87,795,702–87,795,761) contained 27,423 transactions and 5,514 TRC20 transfer calls, with zero zero-value calls. A simulated transfer(0) on the USDT-TRC20 contract (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t), sent from a funded address, used 63,999 energy; at the network's 100 sun per energy that is 6.3999 TRX, about $2.04 at TRX $0.3196. The Ethereum batch cost $0.0016 per log — about 1,300 times less. That cost gap helps explain why the bulk zero-value spam we measured showed up on Ethereum. It does not make TRON safe: the sample is about three minutes, and a fake TRC20 contract or a different transfer method can still plant an address. (XMR to USDT exit)

What it means at the swap form. A swap asks you for a payout address and a refund address; the site gives you a deposit address. On this site, the deposit address is generated per order and appears only after you create it, so it cannot be poisoned in advance. The payout and refund fields are different: they come from your wallet, your address book, or your history. A lookalike pasted into the payout field sends the swap's output to the attacker; pasted into the refund field, it sends a failed order's refund there. Refund fields are filled in a hurry, often copied from a previous order page — exactly the habit poisoning relies on. Monero's longer base58 addresses do not help if the wallet truncates them; the same rule applies. (recovering misdirected funds)

Five checks that work. One: never copy a payout or refund address from a transaction history, an explorer, or a chat. Open your wallet's receive screen, or scan the QR from your own wallet. Two: compare the full string, not the first and last four characters; the middle is where the fake differs. On a hardware wallet, read the full address on the device screen. Three: keep an address-book entry for each coin and network you use, with a label; a saved entry cannot be changed by a $0 transfer. Four: check the network. EVM addresses look identical on Ethereum, BSC, Arbitrum and Base, so an Ethereum poison address can be pasted into a BSC payout field. Five: for a large amount, make a small separate order first; a partial deposit to the main order may be treated as a partial payment, so do not split the deposit unless the provider documents it. (recovering misdirected funds)

What the site can and cannot do. Our order form takes five fields and never asks for a seed phrase or a signature; the payout address is fixed when the order is created, and the order page cannot change it afterwards. That removes approval phishing, but it does not remove the copy-paste risk: the address is whatever you typed. The order page shows the deposit address and the amount; the refund address is stored with the order. If a zero-value token appears in your wallet, do not interact with it, do not copy its address, and hide it if your wallet allows. There is nothing to revoke, because no approval was made. A zero-value transfer cannot move funds; it can only advertise an address. (seed backup guide)

The checklist, and the numbers at writing time. Before sending: full-string compare, network check, address book, hardware screen, and a small separate order for a large amount. The $0 line is not a payment and not a balance; it is an advert. As of writing (7 November 2026, 14:23 UTC), 100 USDT-TRC20 quoted 0.1434147 XMR, 1,000 quoted 1.613784 XMR across two routes (150 bps advantage), 1 XMR sold for 606.72 USDT across two routes (201 bps), and 0.01 BTC bought 1.224825 XMR across two routes (101 bps). The catalog listed 438 assets on 65 networks, with six requiring an extra ID. Quotes move; the live page governs. (XMR to USDT exit)