What we found
We read USDT transfers straight from the public Transfer records of the two USDT contracts on Ethereum and on BNB Smart Chain (BSC), and counted them ourselves. Two samples, two findings, and one more on Ethereum.
- About 1 in 3 USDT transfers moved under $1. In 30 ten-minute windows across October 2026, 34.5% of USDT transfers on Ethereum and 36.7% on BSC were zero-value or under $1. Together they carried less than 0.01% of the value moved.
- At least 1 in 5 of the tiny transfers we could trace came from a lookalike. In a second sample of 800 zero-value and sub-$1 transfers, the sender's address copied the first and last four characters of a wallet the recipient had really transacted with in the previous seven days: 20.2% on Ethereum and 30.7% on BSC, of the transfers we could trace. The chance of that happening by accident is about 1 in 4.3 billion per pair of addresses. That is the fingerprint of address poisoning.
- On Ethereum, 9 in 10 zero-value transfers planted a fake entry the other way. 92.1% of the zero-value USDT transfers in the Ethereum sample went to a lookalike of a wallet the sender had just used: a fake "outgoing" line in the victim's own history.
The two headline numbers come from different samples. They are never multiplied: "1 in 3" times "1 in 5" is not a share of all USDT transfers.
How address poisoning works
A blockchain address is a long string that people rarely read in full. Wallets and explorers often shorten it to the first and last few characters. Address poisoning exploits that habit.
- You pay someone. The payment is public: anyone can see which addresses you deal with.
- They spot it. The attacker generates an address that starts and ends with the same characters as your real counterparty's.
- Dust arrives. They send you a tiny transfer from the lookalike, so it sits in your transaction history next to the real one.
- You copy it. Next time you pay, you copy the address from your history, check the start and the end, and send the money to the attacker.
The zero-value version goes one step further. The ERC-20 token standard treats a transfer of zero as a normal transfer, and on Ethereum a zero-value USDT transfer can be recorded as coming from the victim's own wallet without the victim signing anything. The fake then appears as one of the victim's own outgoing payments, which makes it easier to trust. In our Ethereum sample, almost every zero-value transfer followed this pattern; on BSC, zero-value transfers were rare (17 in the sample).
Sample 1: how much of USDT traffic is dust
Every USDT Transfer record in 30 windows of 10 minutes, one window a day from 2 to 31 October 2026 (UTC), with the start hour rotating through the day. Values are in USDT, read as US dollars.
| Measure | Ethereum | BSC |
|---|---|---|
| Transfers in the sample | 146,996 | 3,193,638 |
| Zero-value | 12.1% | 2.7% |
| Under $1 (not zero) | 22.4% | 34.0% |
| Zero or under $1 — share of transfers | 34.5% | 36.7% |
| Zero or under $1 — share of value | under 0.001% | 0.01% |
| $100,000 or more — share of transfers / of value | 1.3% / 90.7% | 0.04% / 44.5% |
| Dust share in a single window (lowest – highest) | 2.6% – 78.7% | 21.9% – 53.7% |
Sample 2: how much of the dust is poisoning
800 zero-value and sub-$1 transfers, 400 per chain, drawn at random from 10 further windows. For each one we read the recipient's and the sender's USDT history for the seven days before it.
| Measure | Ethereum | BSC |
|---|---|---|
| Sender is a lookalike of a real counterparty of the recipient — share of transfers we could trace (95% interval) | 20.2% (76 of 377; 16.4–24.5%) | 30.7% (77 of 251; 25.3–36.6%) |
| Same, counting untraced transfers as no match | 19.0% (76 of 400) | 19.3% (77 of 400) |
| Same, split zero-value / under $1 | 0% / 30.4% | 0% / 32.9% |
| Zero-value transfers whose recipient is a lookalike of a real counterparty of the sender | 92.1% (117 of 127; 86.1–95.7%) | 29.4% (5 of 17) |
| Either pattern, counting untraced as no match | 48.3% (193 of 400) | 20.5% (82 of 400) |
| Share of the sample we could trace | 94% | 63% |
The two patterns split cleanly: sub-$1 dust comes from lookalike senders; zero-value transfers, mostly on Ethereum, plant a lookalike recipient in the victim's own history. Weighting each window by its number of dust transfers gives 19.2% on Ethereum and 30.4% on BSC for the first row, close to the unweighted figures.
Method
- Data. USDT Transfer events read from Ethereum and BSC through standard node calls (eth_getLogs) on a commercial node service, and counted by ComplyWise. This is our own computation from public records, not a third-party statistic. USDT has 6 decimal places on Ethereum and 18 on BSC; both were converted before bucketing. One USDT is read as one US dollar.
- Sample 1. 30 windows of 10 minutes, one a day, 2–31 October 2026 (UTC), start hour rotating from 00:00 to 23:00 UTC across the days. Every transfer in each window, bucketed as zero, under $1, $1–10, $10–1,000, $1,000–100,000 and $100,000 or more.
- Sample 2. 10 further windows (3, 6, 9 … 30 October, start hour rotating): 10 minutes on Ethereum, 2 minutes on BSC because of its volume. Dust was 34% of transfers on Ethereum in these windows (18,690 of 55,222), in line with sample 1. From each window, 40 dust transfers were drawn at random with a fixed seed, so the draw can be repeated: 400 per chain, 800 in total.
- Real counterparty. An address that sent or received at least 1 USDT to or from the wallet in the seven days before the dust transfer.
- Lookalike. An address whose four characters after "0x" and whose last four characters match those of a real counterparty, without being the same address. Eight fixed hexadecimal characters give a chance match of 1 in 16⁸, about 1 in 4.3 billion per pair, so a match is deliberate.
- The two tests. Main test: the dust sender is a lookalike of a real counterparty of the recipient. Reverse test: the recipient is a lookalike of a real counterparty of the sender — the zero-value variant, where the fake is planted in the history of the wallet shown as sending.
- Untraced transfers. Addresses too busy to read in full (more than about 15,000 transfers a week, by extrapolation — typically exchanges and bots) were skipped, and their transfers counted as untraced. Results are given two ways: as a share of the transfers we could trace, and as a floor that counts every untraced transfer as no match.
- Intervals. 95% Wilson score intervals on each share.
Limits
- Busy wallets are not measured. 19 addresses on Ethereum and 118 on BSC were too busy to read and were skipped. We could trace 94% of the Ethereum sample but only 63% of the BSC sample, so the BSC figure rests on fewer transfers and says nothing about poisoning aimed at exchange or bot wallets.
- "At least 1 in 5" means of the transfers we could trace. Counting every untraced transfer as no match gives 19.0% on Ethereum and 19.3% on BSC — just under 1 in 5. The qualifier stays wherever the number is used.
- The fingerprint is narrow. Only exact four-and-four matches, only counterparties of the last seven days and only real transfers of 1 USDT or more count. Lookalikes built on other characters, older targets or smaller real payments are missed, so the method tends to undercount. The 1 USDT threshold was not sensitivity-tested.
- The rest of the dust is not shown to be poisoning. Unmatched dust may be tests, bots, micro-payments, or poisoning we could not see. The word "poisoning" applies to the matched share only.
- A sample, not a census. Windows cover a small part of each day, and the dust share swings widely from one window to the next (2.6% to 78.7% on Ethereum). One month, two chains, one token: USDT on other chains, including Tron, is not covered.
- Small numbers on BSC zero-value. The BSC reverse-test figure rests on 17 zero-value transfers and is shown for completeness only.
What to do
- Pay from a saved list. Send only to addresses in a saved address book or allowlist, never to one copied from transaction history.
- Check the whole address. Compare the full string, including the middle, not only the start and the end that a wallet screen shows.
- Flag the dust. For compliance and operations teams: alert on tiny inbound transfers from lookalikes of known counterparties, and on zero-value "outgoing" entries the customer never signed. Both are cheap to detect and point straight at an attempt.
The map of who regulates what in Thailand, including the SEC's supervision of digital-asset businesses, is on the landscape page.
The series
On-chain data is ComplyWise's own reading of public blockchain records: one question per issue, the method in full, the limits stated, and no addresses or names.
Frequently asked questions
- What is address poisoning?
- A scam in which an attacker sends a tiny or zero-value transfer from an address that looks like one of your real counterparties, so the fake sits in your history. If you later copy the address from your history instead of a saved list, your payment goes to the attacker.
- Is a tiny transfer to my wallet dangerous in itself?
- No. Receiving dust does not move your funds or give anyone access to your wallet. The risk is the next step: copying the lookalike address from your history when you pay.
- How can a zero-value transfer appear to come from my own wallet?
- The ERC-20 standard treats a transfer of zero as a normal transfer and records a Transfer event for it. On Ethereum, a zero-value USDT transfer can be recorded with your wallet as the sender without you signing anything, so a fake "outgoing" entry appears in your own history.
- Does this mean 1 in 5 of all USDT transfers is an attack?
- No. "At least 1 in 5" is a share of the zero-value and sub-$1 transfers we could trace, from a separate sample. It is not a share of all USDT transfers, and it should not be multiplied by the "1 in 3" figure from the first sample.
- Can the analysis be repeated?
- Yes. The method uses only public on-chain records and a fixed random seed, so the same steps can be run on another month, another chain or another token.
Sources
- Ethereum Improvement Proposal 20 (ERC-20 token standard) — the Transfer event, including zero-value transfers
- ethereum.org — JSON-RPC API, eth_getLogs (the node call used to read Transfer events)
Accessed and last reviewed . Each figure and table cell is traced to a source above.