Crypto entrepreneur Changpeng Zhao, widely known as CZ, has called out Etherscan for displaying spam transactions linked to address poisoning scams. According to CZ, block explorers should do more to protect users by filtering out these malicious transfers entirely instead of allowing them to appear in transaction histories.
The criticism surfaced after a user named Nima experienced a wave of suspicious alerts shortly after making a couple of transactions on the Ethereum network. Nima reported receiving 89 address-poisoning email alerts within just 30 minutes, triggered after making two stablecoin transfers. The incident highlights how quickly automated attacks can target wallet addresses once on-chain activity is detected.
Address poisoning scams have become a growing problem in the crypto ecosystem. Attackers create wallet addresses that closely resemble legitimate ones and send zero-value token transfers to victims. These transactions appear in the user’s transaction history, making it easier for victims to accidentally copy the fake address when sending funds later.
Nima warned others about the attack on social media, saying many users could easily fall for the trick if they rely on their transaction history when copying addresses.
CZ urges stronger filtering by block explorers
CZ pointed out that some crypto wallets already address this issue. He noted that Trust Wallet filters these spam transactions, preventing them from cluttering user transaction records. In contrast, Etherscan still displays zero-value transfers that are commonly used in poisoning attacks.
Another user, Xeift, explained that Etherscan actually hides zero-value transfers by default, but other block explorers such as BscScan and Basescan require users to manually enable a “hide 0 amount tx” option. Because this filter isn’t always active by default across platforms, many users continue to see spam transactions that could lead them to send funds to attacker-controlled addresses.
CZ acknowledged that automatically filtering these transactions could have downsides in the future. For example, micro-transactions between AI agents might use zero-value transfers for communication or signaling. He suggested that artificial intelligence could eventually help distinguish legitimate zero-value transfers from malicious spam.
Additional risks highlighted in large swap incident
Security concerns around on-chain transactions don’t end with address poisoning. Crypto commentator Dr. Favezy pointed to another worrying incident involving a wallet identified as “0x98.” A token swap from that wallet reportedly turned $50 million into just $36,000, raising questions about liquidity routing and how swaps are executed.
According to Favezy, smarter routing systems — potentially powered by AI — could help ensure transactions are directed through the best liquidity sources and prevent massive losses like this.
How address poisoning scams work
Address poisoning attacks exploit a technical quirk in token transfers. Attackers send zero-value tokens using the transferFrom function, which creates transfer events on the blockchain. Because every wallet address has a default approval of zero tokens, attackers can generate these events without actually moving funds.
These fake transfers then appear in the victim’s transaction history. Attackers carefully craft the spoofed addresses so that the first and last characters match a legitimate wallet, making them difficult to spot at a quick glance.
Nima’s case shows just how aggressive these campaigns can be. With 89 poisoning attempts triggered in half an hour, the attack demonstrates how automated systems can rapidly target thousands of active wallets whenever stablecoin or token activity is detected on-chain.
As the crypto ecosystem grows, industry figures like CZ are pushing for better user protection tools to prevent these subtle but potentially costly scams.
Also Read: Coinbase-Backed x402 V2 Brings Multi-Chain, AI-Ready Payments Together
CZ Criticizes Etherscan Over Address Poisoning Spam