Curriculum·G101 Querying On-Chain Data·about 30 min
Schema literacy: accounts, transactions, logs, and events
By the end of this lesson you can
- →Name the core objects of the on-chain schema: accounts, transactions, internal calls, and event logs
- →Explain how address-poisoning scams exploit a reader who sees a transfer's appearance rather than its schema
- →Compute why a zero-value event that looks like a transfer is not one, from the fields alone
- →Read a transaction by its schema, not its display, before drawing any conclusion from it
Graduate · enrolled learners
This lesson opens with An address poisoning campaign, February to May 2024.
- What happened
- Address poisoning is a scam that preys on how people read their own transaction history. The attacker generates a wallet whose address shares the first and last characters of an address the victim really uses, then sends the victim a tiny or zero-value transfer, sometimes a fake token event that never moved real funds, purely to plant the look-alike address in the victim's history. Later, when the victim copies a recipient address from that history, they copy the poisoned one and send real funds to the attacker. In one campaign Chainalysis traced from 28 February to 4 May 2024, 2,774 addresses sent a total of about 69.7 million dollars to poisoned look-alikes, nearly all of it a single transfer on 3 May 2024 of about 68 million dollars in wrapped bitcoin. Nothing was hacked. The victims read the appearance of an entry, the matching characters, rather than its schema, the fact that it was a zero-value or spoofed event from an address they had never actually transacted with.
- The decision point
- The address-poisoning victim and the analyst face the same object and read it differently. On the surface, the poisoned entry looks like a normal transfer to a familiar address. In the schema, it is a zero-value transfer, or a token-transfer event emitted without a real balance change, originating from an address with no genuine prior relationship. The difference is invisible to anyone reading the display and obvious to anyone reading the fields. This is schema literacy, and it is the analyst's second skill after knowing the chain is evidence: the chain's objects, accounts, transactions, internal calls and event logs, each have a defined shape, and the meaning is in the fields, not the rendering. A reader who trusts the rendering can be shown anything; a reader who checks the schema sees what actually happened.
- Recorded loss
- $69,700,000
What you will be able to answer
- →How does address poisoning work?
- →What are the core on-chain schema objects?
- →Can a transfer event appear without funds moving?
- →What is schema literacy?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.chainalysis.com/blog/address-poisoning-scam/
- https://info.etherscan.com/what-is-address-poisoning/
- https://www.certik.com/blog/vanity-address-and-address-poisoning
Confidence high·Volatility medium·Reviewed 2026-09-15·Owner unassigned
Contested
The 69.7 million dollar figure is Chainalysis's total for one campaign, not for address poisoning as a whole, which no source here bounds. Of it, the 68 million dollar WBTC transfer was returned: on 9 May 2024 the scammer sent back the original 68 million in ETH. Chainalysis gives two figures for what the scam kept, about 3 million dollars of token appreciation on the return and a net of 1.49 million dollars after it, without reconciling them.
The schema details (that a transfer event can be emitted without a real balance change, and that displays truncate addresses) are general properties of common chains and token standards, illustrated here rather than tied to one implementation.