[loadman]

Thats crazy it cost that much too , it must work lol
it's not really illegal either is it .

1.5k$-2k$ per day(included rent of private crypto node)

[SUI-3183372]

i used to run this bot from a cloud service provider for testing the profitability

rented 100x 4090 costed me around 1.5k$ per day

Even with all that power, I can only generate 3–6 character addresses, and it takes 3–30 seconds per address.

Second, you have to monitor the mempool to make fast transactions. That also costs money. If you try to run your own dedicated private node for speed, it will cost $1k per month

also need filters to avoid losing money by sending transactions to hot wallets, contracts, etc.

It’s not as simple as “just make a transaction.” There’s math involved—you have to calculate gas fees, batch transactions, and more.

Sometimes daily cost will be $1k-5k

but can generate 100k$-300k$

What sort of scale were you operating at?

On a singular 5070 Ti I can generate an address that matches the first 4 and last 4 characters of a target address in about 3 seconds using not amazing tooling, which on its own is more than sufficient for a singular poisoning, 3 seconds would be well within your target time frame.

If I had a more powerful card, like a 4090 on a CUDA powered address generator, you could generate probably 3.6 to 4 billion addresses per second. Finding an address that matches the first and last 4 is not that difficult at all, 16^8 for roughly 4B tries, so you'd effectively be generating a valid scam address every second. 100x-ing that to 100 4090's means you're generating 100 addresses per second, which feels like overkill considering ETH rarely exceeds 30 TPS, and even then you wouldn't want to be poisoning absolutely everything.

[NoodleBot™]

I've gotta be honest, in 10+ years of crypto this I've seen like once or twice. Where are you guys posting your addresses that they might be seen? I get it could be random but if you're constantly experiencing it...

[SUI-3183372]

I've gotta be honest, in 10+ years of crypto this I've seen like once or twice. Where are you guys posting your addresses that they might be seen? I get it could be random but if you're constantly experiencing it...

They're simply picking active addresses sending funds, these addresses can be seen on any explorer or indexer.

If you watch an explorer and see address 1 send $0.10 to address 2, you can can reasonably assume, "ok address 1 just sent address 2 a test transaction and will likely follow with a much larger transaction".

The rest you probably know, but for those who don't... If you then generate a brand new address, we'll call it address 3, that has the first 4 and last 4 characters that match address 2, you can then send address 1 a transaction containing just dust. The goal is for your address to appear most recently in address 1's list of wallets that they recently transacted with. Then you just pray that when address 1 goes to send their real full transaction, that they send the funds to address 3 by mistake rather than address 2.

Generally the attackers that do this have some sort of trigger that they're looking for, either transactions that look like they may be a test transaction where they can reasonably assume a follow up transaction will take place, or wallets that send funds to the same address numerous times where you can assume they'll likely send to this address again. You don't normally see wide sweeping poisoning attacks that target absolutely everything and everyone.

[Mewtwo]

Thats crazy it cost that much too , it must work lol
it's not really illegal either is it .

Maybe prosecuted for wire fraud? It’ll be super hard to prove intention tbh. There hasnt been any criminal cases with these. Some folks lost millions of dollars from poison addresses. Even the DEA got tricked.

---

I've gotta be honest, in 10+ years of crypto this I've seen like once or twice. Where are you guys posting your addresses that they might be seen? I get it could be random but if you're constantly experiencing it...

I sent my crypto to OKX and that’s when all those spams started happening.

[SUI-3183372]

Maybe prosecuted for wire fraud? It’ll be super hard to prove intention tbh. There hasnt been any criminal cases with these. Some folks lost millions of dollars from poison addresses. Even the DEA got tricked.

I don't think a prosecutor would have a difficult time proving intent, their actions paint a pretty clear picture imo. Wire Fraud is probably right.

I sent my crypto to OKX and that’s when all those spams started happening.

How quickly did the funds move from your OKX deposit address to a known OKX hot wallet?

Did the spam start before or after that movement.

I'd be curious if they're attempting to detect exchange deposit addresses.

[Mewtwo]

I don't think a prosecutor would have a difficult time proving intent, their actions paint a pretty clear picture imo. Wire Fraud is probably right.

How quickly did the funds move from your OKX deposit address to a known OKX hot wallet?

Did the spam start before or after that movement.

I'd be curious if they're attempting to detect exchange deposit addresses.

Sent to OKX on: 2026/02/02 10:36:47
OKX sent to hot wallet on: 2026/02/02 10:46:59

The tx spams started happening on: 2026/02/02 11:49:47


https://debank.com/profile/0x037c1e88837...c6/history

There’s at least like 24 tx they sent which I just don’t understand any purposes why. The wallet is completely empty. Each one has a different address but the same first and last 6 address.

[SUI-3183372]

Sent to OKX on: 2026/02/02 10:36:47
OKX sent to hot wallet on: 2026/02/02 10:46:59

The tx spams started happening on: 2026/02/02 11:49:47


https://debank.com/profile/0x037c1e88837...c6/history

There’s at least like 24 tx they sent which I just don’t understand any purposes why. The wallet is completely empty. Each one has a different address but the same first and last 6 address.

Yeah, my best guess is they determined that the address you sent to is a deposit address for OKX and they're hoping they can hijack any future deposits to OKX that you may make.

A lot of transactions, but only coming from 2 actual addresses, each fake address sends 10+ transactions to you.

One group is spending $0.004132 per transaction to poison
The other group is spending $0.007308 per transaction to poison

One group gets funded by 0xe206F6650305C05620Fa1753AB24E1c7F5e3E6bE, which is a contract, so they have a nice little system built here. Detect people depositing to exchanges, generate deceptive address, smart contract funds the new address, they send poisoning transactions at a seemingly random interval, numerous times per day. Both groups inexplicably take a few days off before ramping back up at one point, wonder if they're just the same group.

[IRLCash]

I must be lucky I've never had this happen to me yet but it is starting to become more of a problem in the Crypto world these days.