Curriculum·G101 Querying On-Chain Data·about 30 min
Schema literacy: accounts, transactions, logs, and events
By the end of this lesson you can
- →Name the core objects of the on-chain schema: accounts, transactions, internal calls, and event logs
- →Explain how address-poisoning scams exploit a reader who sees a transfer's appearance rather than its schema
- →Compute why a zero-value event that looks like a transfer is not one, from the fields alone
- →Read a transaction by its schema, not its display, before drawing any conclusion from it
Graduate · enrolled learners
This lesson opens with Address poisoning thefts, 2023 onward.
- What happened
- Address poisoning is a scam that preys on how people read their own transaction history. The attacker generates a wallet whose address shares the first and last characters of an address the victim really uses, then sends the victim a tiny or zero-value transfer, sometimes a fake token event that never moved real funds, purely to plant the look-alike address in the victim's history. Later, when the victim copies a recipient address from that history, they copy the poisoned one and send real funds to the attacker. Across 2023 and 2024 these thefts took tens of millions of dollars, including single transfers of hundreds of thousands and, in one case, a payment of about 68 million dollars sent to a poisoned address. Nothing was hacked. The victims read the appearance of an entry, the matching characters, rather than its schema, the fact that it was a zero-value or spoofed event from an address they had never actually transacted with.
- The decision point
- The address-poisoning victim and the analyst face the same object and read it differently. On the surface, the poisoned entry looks like a normal transfer to a familiar address. In the schema, it is a zero-value transfer, or a token-transfer event emitted without a real balance change, originating from an address with no genuine prior relationship. The difference is invisible to anyone reading the display and obvious to anyone reading the fields. This is schema literacy, and it is the analyst's second skill after knowing the chain is evidence: the chain's objects, accounts, transactions, internal calls and event logs, each have a defined shape, and the meaning is in the fields, not the rendering. A reader who trusts the rendering can be shown anything; a reader who checks the schema sees what actually happened.
- Recorded loss
- $40,000,000
What you will be able to answer
- →How does address poisoning work?
- →What are the core on-chain schema objects?
- →Can a transfer event appear without funds moving?
- →What is schema literacy?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.chainalysis.com/blog/address-poisoning-scams/
- https://info.etherscan.com/address-poisoning-attack/
- https://www.certik.com/resources/blog/address-poisoning-attacks
Confidence high·Volatility medium·Reviewed 2026-09-15·Owner unassigned
Contested
Aggregate address-poisoning losses are estimated in the tens of millions across 2023 and 2024; a widely reported single case involved a transfer of about 68 million dollars later partially returned. Exact totals vary by source and are hard to bound precisely.
The schema details (that a transfer event can be emitted without a real balance change, and that displays truncate addresses) are general properties of common chains and token standards, illustrated here rather than tied to one implementation.