Can Someone Steal Your Crypto With Just Your Wallet Address?

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: No. Nobody can move your crypto with just your wallet address. Moving funds on Ethereum takes your private key, your seed phrase, or a signature you gave them. What an address does give scammers is a target: they use it for address poisoning (lookalike addresses planted in your history, which a 2025 USENIX Security study tied to at least $83.8 million in losses), fake token airdrops that lure you to drainer sites, and tracking how much you hold. Sharing your address is fine. Copying addresses from your history and interacting with tokens you didn't buy is where people get hurt.

People ask me some version of this almost every week, usually right after they posted their address somewhere and then saw strange tokens or zero-value transfers appear in their wallet. I build MEV and wallet rescue tooling on Ethereum, so I spend a lot of time looking at how funds actually leave addresses. The short version is that the address itself is harmless. The tricks built around it are not.

Can someone steal your crypto if they have your wallet address?

No. A wallet address is public by design, like an account number that anyone can see on a block explorer such as Etherscan. To move anything out of it, a transaction has to be signed with the private key behind that address, or a contract has to hold permission you granted earlier.

An address is a 40-character hexadecimal identifier derived from your public key. A private key is the secret that signs transactions for that address, and a seed phrase (the 12 or 24 words) is what generates your private keys. ethereum.org's page on accounts explains that the address is derived from the public key, and that only the holder of the private key can sign for it.

Here's what each piece of information actually lets someone do:

What the attacker has	Can they move your funds?	What they can do with it
Your wallet address	No	See your balances and history, send you spam tokens, poison your history, target you with phishing
Your ENS name or a social profile linked to the address	No	Connect your holdings to your identity
A token approval or Permit signature you gave	Yes, for that token	Pull the approved tokens with `transferFrom`
A malicious EIP-7702 delegation you signed	Yes	Run their contract code as your account
Your private key or seed phrase	Yes, everything	Drain the wallet and run a sweeper bot on it

So the real question isn't "who knows my address?" It's "did I ever give away a key, a seed phrase, or a signature?" If you're not sure, I wrote a compromised wallet checklist that walks through the on-chain signs.

What is address poisoning?

Address poisoning is a scam where an attacker creates an address that looks like one you use, plants it in your transaction history, and waits for you to copy it by mistake. Nothing is taken from you directly. You send the funds yourself, to the wrong place.

MetaMask's support article on address poisoning describes the usual flow:

You make a normal transfer, often a stablecoin, to a friend, an exchange, or another account of yours.
A bot watching those transfers generates a "vanity" address whose first and last characters match the recipient's.
The attacker sends a transaction from the lookalike address to you, usually a transfer of zero tokens, so it shows up in your history.
Next time you need that address, you copy the lookalike from your history instead of the real one. Wallets shorten addresses to the first and last few characters, which is exactly the part the attacker matched.

The scale is bigger than most people assume. Researchers from Carnegie Mellon measured it on Ethereum and BNB Chain from July 2022 to June 2024 in Blockchain Address Poisoning, published at USENIX Security 2025. They found about 270 million attack attempts targeting 17 million victims, and 6,633 successful incidents that caused at least $83.8 million in losses.

Why do I see zero-value transfers "from" my own address?

Because many token contracts let anyone call transferFrom for an amount of zero, even without an approval. The attacker uses that to create a transfer record that appears to come from you and go to their lookalike address. It costs you nothing and moves nothing, but now your history shows "you" sending to an address that looks familiar.

The same goes for fake tokens. Anyone can deploy a token contract called "USDT" and emit transfer events with your address in them. Explorers like Etherscan flag many of these, but not all, and some wallets still display them.

How did one address poisoning attack cost $68 million?

By looking like a test payment. In May 2024, a large holder sent a small test transfer to the intended address, then sent about $68 million in WBTC minutes later to a lookalike address that matched the first characters. Chainalysis broke down the transactions: the scam address shared the first visible characters with the real one, and the victim's second transfer went to the scammer.

That case had an unusual ending. After on-chain negotiation and pressure from investigators, the attacker sent back roughly 22,960 ETH, which Cointelegraph reported was over 96% of the stolen dollar value at the time. Almost nobody else gets that outcome. Ethereum transfers are final, and a poisoning victim usually has no one to negotiate with.

What I take from it: even careful people who send test transactions get caught, because the test payment itself becomes the thing that gets copied.

How else do scammers use your wallet address?

Beyond poisoning, an address gives scammers three other angles.

Fake airdrops that point to drainer sites. You'll sometimes find a token in your wallet with a name like a URL, or one that claims you can "claim" a reward. Visiting the site and connecting your wallet leads to a signature request, usually a Permit, setApprovalForAll, or an EIP-7702 delegation. That signature is what gives them access, not the token. I cover how these work in wallet drainer approvals: Permit, SetApprovalForAll and 7702.

Honeypot tokens you can't sell. Some unsolicited tokens show a big balance, so you try to sell them. The contract blocks sales, or the "approve" step it needs is the actual attack. My guide to honeypot tokens explains how to read the contract before touching it.

Targeting and tracing. Anyone can see your full balance and history. If your address is linked to your name through an ENS name, a public post, or an exchange withdrawal, people can see what you hold. That can make you a target for personalised phishing or worse. This is a privacy risk, not a direct theft risk, but it's real.

Yes, for receiving funds, sharing your address is normal and safe. Just treat it like a public number that reveals your balance.

A few habits I follow myself:

Use a separate address for public stuff. I keep one address for donations, payments and anything I post online, and hold most funds elsewhere. Different accounts from the same seed are still separate addresses on-chain.
Don't link your main address to your real name unless you're fine with everyone seeing what's in it.
Ignore anything that arrives unsolicited. A token you didn't buy is not a gift. Hide it in your wallet and don't approve, sell or swap it.

How do you protect yourself from address poisoning?

Stop copying addresses from your transaction history, and verify the whole address, not just the ends.

Save the addresses you use in an address book. In MetaMask that's the Contacts menu, which their support page recommends. Exchanges and most wallets have whitelists too.
Check the middle characters before sending. Poisoned addresses are built to match the start and end, so the middle is where they differ.
Confirm on a hardware wallet screen. Most hardware wallets show the full destination address on the device before you approve.
Turn on your wallet's warnings. MetaMask now shows a blocking warning when a destination closely resembles one you've used before, and a warning for addresses you've never sent to.
Be careful with test transactions. Send the test, then copy the address again from the original source (the exchange deposit page, your contact list), not from the test transfer in your history.
Hide spam tokens and zero-value transfers so they don't clutter the list you copy from.

What if you already sent funds to a poisoned address?

You can't reverse an Ethereum transaction. What you can do is document it and protect yourself from the second scam that usually follows.

Save the transaction hash and both addresses.
Report it to IC3 if you're in the US, or your local police cyber unit, and to the exchange if the funds went through one.
Expect "recovery agents" to contact you. Almost all of them are scams. I explain the patterns in crypto recovery scams: how to spot fake recovery services.

Note that address poisoning doesn't mean your key leaked, so your wallet is still yours. If you see funds leaving that you didn't send, that's a different problem, and my first-hour checklist for a drained wallet is the place to start.

Frequently asked questions

Can someone hack my wallet just by knowing my address?

No. An Ethereum address is public and can't be used to sign transactions. Someone needs your private key, your seed phrase, or a signature or approval you gave them to move your funds.

Can someone steal my money if they have my crypto wallet address?

Not directly. They can send you spam tokens, poison your transaction history with lookalike addresses, or try to trick you into signing something on a phishing site, but the address alone gives them no control.

Why did I receive tokens I didn't buy?

Usually it's spam or a scam. Fake tokens and zero-value transfers are used for address poisoning and to lure you to drainer sites. Don't interact with them; hide them in your wallet.

Is it safe to give someone my wallet address to receive crypto?

Yes. That's what addresses are for. Just remember that whoever has it can see your balance and full history, so use a separate address if you don't want that public.

How do I know if an address in my history is poisoned?

Compare it character by character, including the middle, with the address from the original source such as your exchange deposit page or saved contact. If only the first and last few characters match, it's a lookalike.

Can address poisoning drain my wallet?

No. Poisoning only works if you send funds to the lookalike address yourself. It doesn't give the attacker access to your wallet or your tokens.

If your key did leak and a sweeper bot is taking everything that lands in the wallet, that's the problem I work on most. Our token rescue service uses private Flashbots bundles to move what's left before the bot can react, and you can reach me directly on Telegram.