# Received 0 USDT? How address poisoning works

> A mysterious 0 USDT transfer can be an address poisoning attempt. Learn how fake lookalike addresses reach your wallet history and what to check before sending.

Source: https://usepicnic.com/en/blog/address-poisoning-zero-usdt · Published 2026-11-06

You open your wallet activity and see a **0 USDT transfer** you do not recognize. Its address looks almost identical to one you have used before. This may be an *address poisoning scam*. The suspicious entry does not, by itself, mean that your USDT left your wallet or that someone knows your private key. The main danger comes later: copying that address from transaction history and using it for a real transfer.

The most useful rule is straightforward: **do not source a recipient address from transaction history**. Get it directly from the intended recipient or use a contact you created and verified yourself. Before signing, compare the full address and the network. Matching first and last characters are not enough.

## How does an address poisoning scam work?

An attacker watches public blockchain activity and identifies an address to which you have sent assets. They generate a different address that resembles your legitimate recipient, especially at the beginning and end. Many wallets abbreviate addresses in activity lists, making the two look alike at a glance. A tiny transfer, a zero-value transfer, or even a forged token event puts the lookalike in your history.

Suppose you regularly send USDT to `0x12ab…89ef`. A new entry also displays `0x12ab…89ef` in the shortened view. The hidden middle characters differ. Copy the second entry, and your next actual payment goes to the attacker. The trick does not require stealing your password or controlling your wallet. It exploits the appearance of familiarity.

[Etherscan describes two common variants](https://info.etherscan.com/what-is-address-poisoning/): zero-value token transfers and spoofed transfer events from fake tokens. An activity line that looks like an outgoing payment therefore does not always prove you authorized a genuine transfer of that asset. Inspect the token contract, amount and transaction hash on the appropriate block explorer before deciding what happened.

## Does a 0 USDT entry mean my wallet is compromised?

**A zero-value entry alone is not evidence that your keys were compromised.** The usual objective is to plant a bad address for a future send. [Etherscan's explanation of the zero-value transfer attack](https://info.etherscan.com/zero-value-token-transfer-attack/) distinguishes the suspicious entry from an actual loss and advises users to verify complete destination addresses.

Check three things before taking further action:

1. Open the transaction hash in the explorer for the correct network and check the amount actually transferred. Verify whether the token is the genuine USDT contract on that network or an imitation using its name or ticker.
2. Compare your current balance with its earlier state. A zero-value entry does not remove USDT, but an unrecognized nonzero outgoing transaction is a different incident and calls for urgent investigation.
3. Check for approvals or signatures you do not recognize. Address poisoning does not itself require an allowance from you, but another scam can occur at the same time.

If the only suspicious activity is a zero-value entry and your balance is intact, do not move assets to a supposed “safe wallet.” Do not reply to the transfer, “return” the token or follow a link embedded in an unknown token's name. [Trezor advises ignoring unsolicited assets and never sharing a wallet backup](https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing). If there is a real outgoing transfer you did not authorize, treat that as a separate possible compromise and contact your wallet provider through official channels.

## What should I check before sending crypto again?

The important defense takes place at your next send, not when you try to erase the activity entry. Use this checklist:

- **Return to the original source.** Copy the address from the receiving platform's official deposit screen or confirm it with the intended recipient over a trusted channel. Do not reuse an address from an activity row, an unexpected message or an automatically suggested recent recipient without checking its origin.
- **Compare the entire address.** Inspect the middle characters, not just the first and last few. If your wallet or signing device has a review screen, compare its displayed destination with the original source.
- **Confirm the asset and network.** An `0x` address can appear on several EVM networks, but that does not mean a receiving platform accepts the token on all of them. Address matching is separate from [checking the network before a crypto transfer (Portuguese guide)](https://usepicnic.com/br/blog/errar-a-rede-ao-enviar-cripto).
- **Use contacts that you entered and checked.** An address book reduces repeated copying from history only if you verified the original entry and it remains valid. An automatically populated “recent recipient” is not equivalent to a verified contact.
- **Consider a small test, then verify again.** A test can establish that one destination received a small transfer. It does not make a similar-looking history entry safe for the larger payment. Obtain the address from the original source again.

If any character differs, stop. The amount in the row, its position in the list and a familiar-looking label cannot tell you which address is legitimate.

## What if I already sent USDT to the wrong address?

First, do not send another payment. Preserve the transaction hash, network, destination address, amount and time. Compare the destination in the confirmed transaction with the address supplied by the intended recipient. If they differ, contact the platform you used to send the assets promptly and share those details. It may be able to assess available steps, but **a confirmed blockchain transfer cannot be assumed reversible or recoverable**.

If the attacker's address belongs to an identifiable platform, alerting that platform quickly and reporting the incident to relevant authorities may support an investigation. Neither step guarantees a refund. Be wary of anyone who offers “guaranteed recovery” in exchange for a fee, password or recovery phrase: that can be a follow-up scam. Our [Portuguese guide to crypto scams in Brazil](https://usepicnic.com/br/blog/golpes-de-cripto-no-brasil) covers evidence preservation and other fraud patterns.

## Can Picnic's saved addresses help?

Picnic lets you [save recipients for EVM-network withdrawals (Portuguese guide)](https://usepicnic.com/br/blog/picnic-enderecos-salvos-carteira-cripto) under a name you choose. The address remains visible for checking during withdrawal review. That means you do not have to find an old transaction and copy its destination each time. It is a tool against the habit address poisoning exploits, **not a guarantee that a saved address is correct**.

The contact's origin matters. Save it only after obtaining the address directly from the recipient and confirming the network. Save a malicious history entry, and the address book simply retains the mistake. Picnic can also show recent recipients after successful withdrawals, but a recent entry is not identity verification. Reconfirm a destination if its platform may have changed its deposit instructions.

This address book covers EVM destinations, not native Bitcoin or Solana addresses. On every withdrawal, review the network, asset, amount and destination. With self-custody, you retain control of your assets and authorize each transfer; that control makes the final review especially important.

## The rule that prevents the next loss

An unexpected 0 USDT entry may be no more than an attempt to put a lookalike address in your path. There is no way to “clean” a public blockchain, and hiding one suspicious entry in an explorer does not remove the risk of copying the wrong recipient elsewhere. You can control your next decision: return to the original source, compare the full address and network, and only then sign.

If you move USDT often, make this a routine before larger transfers. Keep purpose-specific contacts, review them when a receiving platform changes its deposit details, and do not turn transaction history into an address book. Picnic's saved EVM recipients can reduce repetitive copying; the withdrawal review remains the last opportunity to spot a mismatch. A minute of careful checking matters more than familiar-looking first and last characters.

---

_Picnic is a technology platform that lets users independently interact with USDC, a U.S. dollar-pegged stablecoin issued by Circle, on public blockchains. USDC is not legal tender in Brazil._

_Displayed exchange rates vary with market conditions. The final applicable amount is the one shown on the transaction confirmation screen. Cryptoassets involve risks, including volatility and loss of peg._

_Picnic does not custody user assets and is neither a financial institution nor a virtual asset service provider. Sending and receiving U.S. dollar payments through a U.S. account is offered in partnership with Noah Savings Inc. Terms and conditions apply._

_Information verified in November 6, 2026._