Address poisoning

Address poisoning is an attack not on the protocol but on the human and their habits. The attacker creates a "lookalike" address, outwardly similar to one the victim has already interacted with, and slips it into the transaction history so that, on the next transfer, the victim copies the wrong address. One click of "copy from history" — and a large sum goes to the attacker. Let us take apart the mechanics of the lookalike, recall a real $68 million case, understand why this works at all, and how to protect yourself.

The mechanics of the lookalike

Crypto addresses are long and unreadable (0xd9A1...853a91), so wallets and explorers almost always show them abbreviated: the first few characters, an ellipsis, the last few characters. A person does not check all 40 hex characters — they look at the "beginning and end." It is precisely this habit that the attack exploits.

Using a vanity-address generator, the attacker finds an address whose first and last characters match the victim's real recipient address. A full match of every character is cryptographically impossible, but a "head-and-tail" match is a matter of computational brute force, and it is enough to fool the eye under abbreviated display.

The lookalike address matches the original at the beginning and end — under abbreviated display (0xAbCd…1234) they look identical.

Attacker
generates a lookalike address

→

Poisoning tx
micro-transfer/fake token
into the victim's history

→

Victim copies
from history

→

Money to the attacker

How the lookalike gets into the victim's history

Reconnaissance. The attacker monitors large wallets and their frequent counterparties: to whom and to which addresses the victim regularly sends funds.All of this is public on the blockchain.
Generating the lookalike. For the target recipient address, a vanity address with the same beginning and end is found.The longer the matching prefix/suffix, the more convincing — and more expensive — the search.
"Poisoning" the history. From the lookalike, the victim is sent something that will settle in their transaction feed next to the real ones: (a) a micro-transfer of the native coin or a stablecoin worth pennies; (b) a transfer of a fake token with the same ticker; (c) especially insidious — a zero-value transfer via the transferFrom vulnerability for 0 tokens, which requires no consent from the victim yet appears in their history as "outgoing to the lookalike."The last variant makes it look as if the victim themselves had already sent to this address.
Waiting for the mistake. The next time, in a hurry, the victim copies the "familiar" address from history — and transfers to the attacker.The attack is passive: the victim commits the fatal action themselves.

A real case: $68 million in a single transfer

One of the most notorious incidents: the victim intended to send a large sum in WBTC to their usual address, but copied a lookalike address from history and transferred about $68 million straight to the attacker. The on-chain details of the case (for practice — this is how the breakdown looks in an explorer):

The transfer transactionThe hash begins with 0x87c6e5…bf73 — by it, the explorer shows the funds going to the wrong address.
The poison addressBegins with 0xd9A1 and ends with 853a91 — the same beginning and end as the real recipient, hence the deception under abbreviated display.
The outcomeUnder public and analytical pressure, a significant part of the funds in this case was later returned — a rare but telling outcome.

The important lesson of the case: an experienced holder with a large balance was the victim. Address poisoning is not about "inexperience" — it is about the universal human habit of trusting the abbreviated view of an address.

Why this works at all

The root of the problem is the abbreviated display of the address. Wallet interfaces and explorers hide the middle of the address for readability. The brain checks 4–6 characters at the beginning and 4–6 at the end and concludes "this is the one." The attacker does not need to break cryptography — it is enough to match the visible part. Add to this haste, the muscle memory of "copy from history," trust in one's own transaction feed (after all, "it can't be faked"), and the bad habit of reusing addresses — and you get an almost perfect social-engineering trap built right into the UX.

An additional insidious layer is zero-value transfer poisoning: the attacker crafts a record in the history as if it were the victim themselves who had earlier sent to the lookalike address. Psychologically, an outgoing transaction inspires more trust than an incoming one ("since I already sent there, that address must be my correct one"), and the probability of copying rises.

How to recognize it and protect yourself

Never copy an address from the transaction historyThe main rule. The history is exactly where the attacker plants the lookalike. The source of an address must be trusted only: a saved contact, a QR code from the recipient, your address book.
Use a whitelist/address bookEnter verified addresses once and send only by label, not by "fresh" strings from the feed.
Verify the address in full, not just the "beginning-end"Check the middle characters too. Better still — verify the first/last 8–10 characters, not 4.
A test micro-transfer for large sumsBefore sending millions, send a token amount and confirm receipt with the counterparty via an independent channel.
Ignore "dust" and unfamiliar tokens in the historyMicro-transfers and fake tokens with a familiar ticker are a likely lure. Do not interact, do not copy (more on this in lesson 7.6).
Trust the wallet's warningsMany wallets and explorers already flag "poisoning" addresses and zero-value transfers. Do not disable these checks.

A sign on the graph for the analyst. Poisoning is recognized as follows: shortly before a large "erroneous" transfer, an incoming micro-transfer or zero-value transfer appears in the victim's history from an address whose beginning and end match the real recipient. Two "twin" addresses side by side in the feed are almost a diagnosis. If you are investigating an incident, look for this lookalike address and its "poisoning" transaction immediately before the loss of funds.

In sum: address poisoning is an attack on the habit of trusting the abbreviated view of an address. The mechanics — a vanity lookalike with a matching beginning and end, planted in the victim's history via a micro-transfer, a fake token, or a zero-value transfer, in the expectation of a copy "from history." The real ~$68 million case (tx 0x87c6e5…bf73, poison address 0xd9A1…853a91) showed that even large, experienced holders are vulnerable. The defense is to not copy from history, keep a whitelist, verify the address in full, and make test transfers. In the final lesson of the section we will gather the adjacent techniques of the "junk" layer: nested exchanges, dusting, and spam tokens.

← Programme Programme →

This material is for educational purposes.