Address poisoning: the copy-paste trap

Crypto addresses are long and hard to read, so most people check only the first and last few characters. Address poisoning exploits exactly that habit.

How it works

1. You send funds to an address you use often, for example your exchange deposit address or your own second wallet.
2. An attacker's bot sees this and generates an address with the same first and last characters.
3. The bot sends your wallet a tiny amount, a zero-value transfer, or a fake token from that lookalike address. Now it sits in your transaction history right next to the real one.
4. Next time you copy "the usual address" from your history, you may copy the attacker's lookalike. The funds are gone.

Large losses from this trick, including single transfers worth millions, have been reported publicly. It works on any account-based chain and with stablecoins in particular.

Habits that make it fail

• Never copy addresses from your transaction history or from a block explorer list of recent transfers.
• Use an address book. Save each address you use regularly once, after verifying it carefully, and pick it from the address book every time.
• Check the whole address, or at least many characters in the middle as well as the ends.
• Send a small test transaction for large transfers, then confirm with the recipient through a separate channel that it arrived, and only then send the rest.
• Use exchange address allowlists, so withdrawals can go only to addresses you have pre-approved. See exchange security.
• Use naming services carefully. Human-readable names (for example ENS names) help, but verify the name itself is right: lookalike names exist too.

Clipboard malware

A related attack uses malware on your computer that replaces any crypto address you copy with the attacker's address. If the pasted address does not match what you copied, your device may be infected. Verifying the receiving address on a hardware wallet screen helps. See device hygiene.