What is address poisoning, and how do I avoid it?

The full answer

How does an address-poisoning attack work?

The FBI’s Denver office described the attack in a warning on April 26, 2024 [1]. Criminals send tokens to a victim from an address that closely resembles one the victim has dealt with before [1]. The FBI called this an address-poisoning attack [1]. The bet is that the victim will not double-check the recipient and will send the next payment to the criminal’s address instead [1].

Wallet software makes this possible. The FBI said wallets truncate addresses, so a fake can share the first few and last few characters with a familiar address while the middle characters differ [1]. A glance at a shortened address in a transaction list will not show the difference.

The tokens used can be fakes too. In the same April 2024 warning, the FBI said criminals were creating tokens that impersonate well-known ones such as Tether (USDT) and other stablecoins [1]. Ripple’s scam guidance, checked September 29, 2026, lists unfamiliar tokens appearing in a wallet as a warning sign [11]. Our page on strange tokens and airdrops in an XRP wallet covers those in more detail.

Has address poisoning been measured on the XRP Ledger, and is it growing?

No regulator, court or XRP Ledger documentation had published a count of address-poisoning attempts or losses on the XRP Ledger as of October 1, 2026. Whether the attack is growing there is not known. The FBI’s 2024 warning names Tether and other stablecoins but no specific blockchain [1].

The ledger’s own rules shape what an attacker pays. An address must hold a minimum amount of XRP to exist as an account [3]. On Mainnet that base reserve is 1 XRP, according to the XRP Ledger documentation checked September 29, 2026 [3]. A standard transaction costs a minimum of 10 drops [6], and one drop is 0.000001 XRP [7]. Addresses are public information [4], and a key pair and its address can be generated entirely offline without contacting the ledger [5].

How do I save and label trusted addresses in my wallet?

The FBI’s rule is to check the entire address so it fully matches the one you mean to pay [1]. A saved entry carries that check forward only if every character was compared when it was saved, against a source you trust and not against your transaction history.

Exchange addresses need one more detail. The XRP Ledger documentation says a payment to an exchange can carry a destination tag that tells the exchange which customer to credit [8]. A saved exchange entry is incomplete without it. The destination tag page explains what happens when it is missing, and our guide on moving XRP from an exchange to your own wallet walks through a full send. To compare an address against a past transaction, the page on reading an XRP Ledger transaction on a public explorer shows where the full address appears.

Can the XRP Ledger block unwanted transfers from strangers?

It can, but there is a cost. Deposit Authorization is an optional account setting that blocks all transfers from strangers, including XRP and tokens [2]. With it on, the account can receive value only from accounts it has preauthorized or by sending a transaction itself to collect funds [2]. Deposit Preauthorizations count toward the account’s owner reserve [3], which is 0.2 XRP per item on Mainnet [3]. The setting sits alongside other ledger controls described on our page about XRP Ledger account security features.

What if I already sent XRP to a poisoned address?

The payment is almost certainly final. The XRP Ledger documentation says no privileged administrator can undo or reverse a transaction once it has applied [4]. Ripple says it cannot stop or alter XRP Ledger transactions [11]. The FBI’s Internet Crime Complaint Center calls crypto transactions irrevocable [9], and the FTC says that if you send crypto to the wrong person, no one is likely to be able to step in and recover it [10].

Reporting still matters. The IC3 asks for the crypto addresses, amounts and types, transaction hashes, and dates and times [9]. In Canada, the Anti-Fraud Centre’s victim page, dated January 16, 2026, says to report to local police and get a file number, and to report to the Centre at 1-888-495-8501 [12]. The same page warns that fraudsters often target victims a second or third time with promises of recovery [12], and the IC3 warns against recovery services that charge an up-front fee [9]. More steps are on our pages about a transfer that went to the wrong place and crypto recovery scams.

What is the case against relying on these checks?

The FBI’s own account places the weakness in wallet software, which truncates addresses [1]. Its advice still asks the person sending to catch a difference hidden in the middle of a long string [1]. The ledger-level fix has its own cost: Deposit Authorization blocks transfers from all strangers [2], not only attackers, and each approved sender adds to the reserve [3]. The page on sending XRP without losing it sets out the wider send process and where each check can still fail. Address poisoning relies on a mistaken payment you make yourself; a related attack, covered under malicious signing requests and wallet drainers, relies on getting you to approve something you did not intend.