The Rising Risks of Address Poisoning and OTC Scams in Crypto: Implications for Institutional Investors

The cryptocurrency ecosystem, once hailed as a bastion of decentralization and innovation, is increasingly under siege from sophisticated cyber threats that exploit both technical vulnerabilities and human psychology. For institutional investors, the stakes have never been higher. Between 2023 and 2025, two particularly insidious risks-address poisoning and over-the-counter (OTC) scams-have emerged as systemic threats, exposing critical weaknesses in crypto infrastructure. These attacks are not isolated incidents but part of a broader pattern of exploitation that demands urgent action from market participants and regulators alike.

Address Poisoning: A Technical and Psychological Exploit

Address poisoning attacks leverage the intersection of smart contract technology and user behavior to deceive even the most cautious actors. By creating fake ERC-20 tokens with identical symbols to legitimate assets (e.g., a counterfeit "ETH" token) and deploying smart contracts to generate "backwards transactions" that mimic user activity, attackers create a veneer of legitimacy. For example, in May 2024, a $68–70 million theft occurred after a victim was tricked into sending funds to a malicious address that appeared identical to a trusted one, differing only by a few characters according to Crystal Intelligence. Carnegie Mellon University's research further underscores the scale of the problem: between July 2022 and June 2024, over 270 million address poisoning attempts were recorded on Ethereum and BSC, resulting in $83.8 million in losses according to Merkle Science.

The psychological dimension of these attacks is equally alarming. Most users verify only the start and end of wallet addresses, a habit attackers exploit by crafting lookalike addresses that diverge subtly in the middle. For instance, a whale lost $68 million in wrapped Bitcoin to an address beginning and ending with "0xd9A1" and "53a91," a near-identical mimicry that bypassed manual checks according to Naoris Protocol. Compounding this, 14% of spoofed addresses now incorporate invisible zero-width joiners, rendering them undetectable in wallet interfaces according to Webacy.

OTC Scams: Exploiting Unregulated Intermediaries

While address poisoning targets technical and behavioral vulnerabilities, OTC scams exploit the lack of oversight in decentralized and semi-regulated markets. North Korea has emerged as a dominant actor in this space, industrializing crypto theft through social engineering and OTC brokers. In 2023–2025, North Korean hackers stole over $2.7 billion by compromising centralized exchanges and custodial services, then laundering funds through the "Chinese Laundromat"-a network of underground bankers and intermediaries in Southeast Asia according to Trmlabs.

Institutional investors are not immune to such tactics. The collapse of Celsius and the fraudulent activities of Praetorian Group International, which defrauded 90,000 investors, highlight the risks of unregulated OTC trading and opaque lending practices according to Dynamis LLP. The DOJ's prosecution of Bybit's CEO following a $1.5 billion exploit in 2025 further illustrates the systemic fragility of custodial systems according to Trmlabs.These cases reveal a troubling trend: institutional actors often lack the tools to verify the legitimacy of OTC counterparties or detect premeditated fraud.

Systemic Vulnerabilities and the Need for Compliance Tools

The rise of address poisoning and OTC scams points to deeper flaws in crypto infrastructure. For address poisoning, the problem lies in wallet design and user education. Empirical testing of 53 Ethereum wallets revealed that many fail to provide adequate warnings for fake transfers, with six wallets displaying malicious activity without alerts according to Emergent Mind. Similarly, OTC scams thrive in the absence of standardized compliance protocols for intermediaries, enabling attackers to exploit jurisdictional arbitrage.

Robust compliance tools are essential to mitigate these risks. Know Your Transaction (KYT) systems, for instance, can monitor deposit risks and trace proximity to known threats, enabling real-time escalation of high-risk activities according to ArXiv. Institutional investors must also adopt advanced wallet interfaces that flag suspicious addresses and avoid features like address shortening, which obfuscate malicious inputs according to ArXiv. Protocol upgrades, such as Ethereum's EIP-4844, may also reduce the attack surface by improving transaction finality and smart contract transparency.

Conclusion: A Call for Proactive Defense

For institutional investors, the lessons are clear: the crypto ecosystem's vulnerabilities are no longer theoretical. Address poisoning and OTC scams represent a new frontier of risk, one that demands a combination of technical safeguards, behavioral training, and regulatory vigilance. As attackers grow more sophisticated, the onus falls on market participants to adopt compliance tools that go beyond basic KYC checks. Failure to do so could result in catastrophic losses, eroding trust in an industry already grappling with volatility and scrutiny.

The time for reactive measures is over. The future of institutional crypto investing hinges on proactive defense.