A 0 USDT transfer has appeared in your wallet, or a token you have never seen. On its own it cannot move your money. Someone sent it to leave an address in your transaction history, and it only matters on your next transfer, if you copy that address back out. This is address poisoning, also called a look-alike address scam.
- The transfer comes from an address with the same first and last characters as one you use and a different middle. If you never copy an address from your transaction history, it does nothing.
- Save the addresses you use often to an address book or whitelist, and when you check by eye, read the middle characters. Don't tap an unknown token or visit the site it points to in order to "redeem" it.
- If you already sent to the wrong address: a stablecoin with an issuer, such as USDT, can still be frozen, so report it quickly. Native coins such as ETH and BTC have no such route.
Why a 0 USDT transfer shows up in your wallet
On a blockchain, anyone can send a transfer to your address. It doesn't need your consent, any more than a flyer pushed through your letterbox does.
MetaMask's help center describes the sequence in its article on address poisoning scams. You make an ordinary transfer. The attacker uses a "vanity" address generator to create an address that closely matches one involved in it: both might start with 0x7a3f and end with 9c2e, with only the middle different. From that address they send you a transaction of negligible value, usually a transfer of zero tokens. It then sits in your transaction history among the real ones.
Nothing has left your wallet. What has changed is that an address that looks familiar is now in your history.
Why checking only the start and end of an address goes wrong
An address is a long string of letters and numbers. The MetaMask article says people recognize addresses by becoming familiar with the start and the end, not by knowing every character. Those two ends are what a poisoned address copies. You glance at it, see 0x7a3f at the front and 9c2e at the back, paste and confirm, and the coins go to the attacker's address. A confirmed on-chain transfer cannot be reversed.
The more direct route is tapping an entry in your transaction history and copying the address from it. In MetaMask's words, address poisoning relies on user carelessness and haste above all else. The attacker doesn't need access to your wallet or a signature from you, only for you to copy that address out of your history once.
0 USDT, a few cents, an unknown token: what to do with each
When something turns up in your wallet that you didn't ask for, work out which of these it is:
| What you see | What it actually is | How to handle it |
|---|---|---|
| An incoming transfer of 0 USDT | Address poisoning: a look-alike address placed in your history | Leave it alone. If you don't copy addresses from your history, it can't do anything |
| An incoming transfer of a few cents | Also poisoning. Where a chain won't carry a zero-value transfer, a tiny amount is sent instead | Same as above: ignore it |
| A "token" you have never seen | Possibly a spam airdrop. Some point you to a website to "claim" or "redeem" it | Don't tap it, don't visit any site linked to it, don't approve anything |
How these are displayed varies by wallet and by chain. None of them reduces your balance by itself. The risk is in what it gets you to do next: copy an address, follow a link, sign an approval.
When you see one, there is nothing you need to do
Don't try to "get rid of" it. Don't tap it, don't open the token's page, don't follow a prompt to "claim" or "redeem". Interacting with it and signing an approval is the step where things go wrong, as explained in fake airdrops that get you to sign an approval. Can it be deleted? Records on a blockchain can't be. If your wallet lets you hide tokens, you can hide it, and leaving it visible does no harm.
The three forms address poisoning takes
Zero-value or tiny transfers
0 USDT or a few cents is sent to your wallet so that an address with matching first and last characters is left in your history.
Fake tokens and spam airdrops
A "token" lands in your wallet unasked, sometimes showing a high value, to draw you to a website to "redeem" it. What that website asks you to sign is an approval.
A transfer that arrives right after a real one
You have just sent funds to an address, and a small or zero-value transfer comes in from a look-alike address. Sitting next to your real transaction, the fake address looks like a receipt from the other side.
The response to all three is the same: don't interact, don't copy, and check the whole address before you send.
How to protect yourself from address poisoning
It only works when you copy an address from your history or check just the two ends. The first four points below are what the MetaMask article recommends:
- Verify the destination address before you send, especially when the amount is large.
- Read the middle characters, not only the start and the end. The middle is the part a poisoned address is counting on you to skip.
- Don't copy addresses from your transaction history. If you do, check the address as carefully as one from an unknown source. That applies to transfers between your own addresses too, such as a withdrawal from an exchange to your own wallet.
- Save the addresses you use often to an address book. In MetaMask this is "Contacts" in the menu. What you save there is an address you have verified, and you pick from it afterwards. An exchange's withdrawal address book or whitelist works the same way. With a hardware wallet you also confirm the destination address on the device before the transaction goes through, which is one more check.
- Before a large transfer, send a small one first. Wait for the other side to confirm it arrived and the address is right, then send the rest.
You already sent coins to a poisoned address: what can you still do?
A confirmed on-chain transfer cannot be reversed, and no platform's support team can undo it. What differs is the coin. If you sent a stablecoin managed by an issuer, such as USDT, the issuer can freeze tokens held by users under its own terms. Your part is to report it quickly so that law enforcement can take it up with the issuer, and nobody can promise a result. Native coins such as ETH and BTC have no issuer to go to. Start with these two things:
Compare the full addresses to confirm where the money went
Take three addresses: the recipient of the transfer you made, the correct address you meant to send to, and the sender of the 0 USDT (or small) transfer in your history. Compare them character by character from start to finish. If the recipient matches the sender of the poisoning transfer, you know it was address poisoning. Screenshot all three addresses together with the transaction hash, because you will need them when you report.
Close off the habit that led to it
Save the correct address to your wallet's or exchange's address book or whitelist now, and pick from there from now on. The poisoning record is still in your history, and as long as you keep copying from history, the same thing can happen again.
For where to report and what to bring, see Scammed in Crypto? What to Do and Where to Report It.