"Over these 18 months, just shy of 48,000 transactions were sent that match this profile of potential address poisoning," Lopp added.