What is address poisoning?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 4 min
In short
Address poisoning plants a lookalike address in your transaction history — same first and last characters as one you really use — hoping you will copy it from there and send to the wrong place. The attack targets the habit of pasting from history. Taking the destination from a saved address book or a QR code instead removes most of the risk.
Key points
- A lookalike address is planted in your history
- It targets the habit of copying from past transactions
- Take destinations from a saved address book or QR code
- Check the whole string, not just the ends
Definition
Creating an address whose leading and trailing characters match one you genuinely use, then getting it into your transaction history so that you copy it as the destination for a later transfer.
Wallets and history screens abbreviate long addresses to something like the first six and last four characters. An attacker builds an address that matches exactly those visible parts, then gets it into your history — typically by sending you a negligible amount or a worthless token.
The next time you pay that counterparty, copying the familiar-looking entry from history sends the funds to the attacker instead. On-chain transfers cannot be reversed, so once the transaction confirms there is no recovery process, and the larger the payment the worse the outcome.
The fix is a change of habit rather than a tool. Save frequent destinations in your wallet's address book and always pick from there; for exchange deposits, scan the QR code shown on the exchange's own screen each time. For a first or large transfer, send a small test amount and confirm it arrived before sending the rest.
Watch out for
- · Never copy a destination from transaction history — use a saved contact or the QR shown by the service itself
- · After pasting, compare the middle of the string too, not only the first and last characters
- · For a first or large payment, send a small test amount and confirm receipt before the rest