We run 19 paid x402 services — 800+ endpoints selling data to AI agents for USDC micropayments. This morning we topped up our fleet's payer wallet with $15 and ran a routine payment sweep to prove the rails end to end.
Minutes into the sweep, our revenue channel on Discord pinged twice with something that should be impossible: a $0.0000 payment.
Our cheapest endpoint costs $0.001. Nothing on our fleet can produce a zero-dollar sale. Whatever those alerts were, they weren't customers.
The tell was four characters on each end
We pulled the transaction from the chain. It wasn't a payment — it was a batch transaction spraying microscopic amounts of USDC, a hundredth of a cent at a time, at dozens of unrelated wallets. Buried in the batch: a transfer of $0.000015 to one of our revenue wallets.
The sender was the interesting part.
our real payer wallet: 0x4C4138cf1cB7db0A48476B2c808Cb3ce0DD1f807
the attacker's wallet: 0x4c418416ffd4ee80aeb7d3b1bb275b835322 7807
^^^^ ^^^^
same same
Same first four characters. Same last four. The thirty-four characters in between — completely different.
That's not a coincidence. Wallet addresses are effectively random, so an attacker can cheaply grind through millions of candidates until one starts and ends with the same characters as yours. And here's the uncomfortable truth every wallet app, block explorer, and Discord bot shares: they all display addresses truncated, as 0x4c41…7807. Both wallets above render identically in almost every interface you use.
The scam, in plain language
It's called address poisoning, and the dust transfer is not the theft — it's the setup.
By sending a fraction of a cent from their lookalike wallet to yours, the attacker plants their address in your wallet's transaction history. It sits there looking exactly like your own wallet, one line among your real transactions. Then they wait.
The payoff comes weeks or months later, the day you — or your bookkeeper, or your automation — need to send funds and grab the address the fast way: scroll the history, spot the familiar 0x4c41…7807, copy, paste, send. The money goes to the attacker, and on a blockchain there is no undo, no fraud department, no chargeback. This scam has taken tens of millions of dollars from real victims; the most famous single case lost $68 million in one copy-pasted transfer.
What startled us was the speed
- ~4 hours between funding the wallet and the first poisoning attempt
- 2 hits, at 11:54 and 11:58 UTC — both fired while our payment sweep was still running
- $0.000015 per attempt — the lookalike address itself costs nothing but electricity to grind
Nobody targeted us personally. Bots watch the chain for freshly funded, newly active wallets, auto-generate a lookalike, and dust every counterparty the target touches. Our wallet started making payments; within minutes, machinery on the other side was seeding fake history into the wallets we'd paid. It's fully industrialized, and it costs so little that every active wallet gets this treatment eventually. Yours will too. The only question is whether it matters when it happens.
Why the agent economy is the perfect target
Address poisoning is old news in DeFi. But x402 and agent payments make an unusually rich hunting ground, for structural reasons:
1. Hot wallets, constant motion. Selling to agents means wallets that pay and get paid all day in small amounts. Every transfer is a fresh signal to the poisoning bots and a fresh line of history for a fake address to hide in. A cold-storage whale gets dusted once; an x402 operator gets dusted on schedule.
2. Addresses travel through chat. Agent operators live in Discord alerts, dashboards, and monitoring feeds — surfaces that all truncate addresses to first-and-last characters, the exact format the attack exploits. We take our own wallet address from a Discord bot more often than we'd like to admit. That habit is precisely what the attacker is betting on.
3. The agents themselves can be victims. An automation that "tops up the usual wallet" by reading recent transaction history — a completely natural thing to build — will copy the poisoned address without ever feeling suspicious. Software doesn't squint at the middle characters unless you tell it to. As more non-technical builders wire up agents that move money, this failure mode ships by default.
The defense is boring, and it works completely
Good news: this attack has a 100% cure, and it costs nothing. The dust in your wallet is harmless — it's real money, it can't hurt you sitting there, and you never need to touch it. The attack only succeeds at the moment someone copies the wrong address. Remove that moment and the whole industry of it goes dark.
1. Never copy an address out of transaction history. Not from a block explorer, not from a Discord alert, not from your wallet's activity feed. History is the one surface the attacker can write to. Keep your addresses in one trusted place — a doc, a password manager, your service config — and copy from there, every time.
2. Check the middle, not the ends. The first and last four characters are exactly what the attacker matched. If you verify by eye, read a chunk from the middle — they almost certainly couldn't afford to match those too.
3. Give your automations an address book, not a search habit. Any agent or script that sends funds should have its destinations pinned in configuration and compare them full-length, character for character. Never let software derive a destination from chain history. One line of config is the difference between immune and exposed.
4. Make your monitoring refuse to repeat the lie. Our Discord bot faithfully relayed the attacker's transfer as a $0.0000 payment — putting the poisoned address in front of exactly the humans it was aimed at. We patched it the same hour: transfers below our cheapest real price are now logged as suspected poisoning and never alerted. If your fleet has a price floor, your alerts should enforce it.
5. Test-send before large transfers. Moving something that would hurt to lose? Send a token amount first, confirm arrival, then send the rest. Thirty seconds of ceremony, permanent immunity to the worst version of this.
The part that stays with us
The attack cost thirty-thousandths of a cent and launched within minutes of our wallet doing anything worth impersonating. It failed here for an unglamorous reason: a $0.00 payment looked wrong to someone who knew the fleet's cheapest price, and we pulled the transaction instead of shrugging.
That's the whole lesson. As agent payments pull in builders who've never had to think like a blockchain security auditor — which is the point of x402, and a good thing — the defenses have to live in habits and tooling, not vigilance. Vigilance doesn't scale. Address books, full-length comparisons, and alert thresholds do.
We publish everything we learn operating 500+ paid x402 endpoints — including the incidents. More field notes at forgemesh.io/blog, and a free scan that checks whether stock agent clients can actually pay your endpoint.
Top comments (0)