Address Poisoning

Overview

Understand the idea

Address poisoning exploits user habits rather than a weakness in blockchain cryptography. The attacker studies an address the victim commonly uses, creates a different address with similar beginning or ending characters, and sends a small or zero-value transaction involving the victim. The deceptive address then appears in the victim’s recent activity.

If the victim later copies a destination from transaction history and checks only a few visible characters, funds may be sent to the attacker. The attack is especially effective in interfaces that shorten addresses or emphasize only prefixes and suffixes.

A valid checksum does not prevent poisoning because the attacker’s address is a valid address with its own correct checksum. Protection depends on verifying the complete destination, using trusted address-book records, confirming changes through a separate channel, and avoiding blind reuse of addresses from transaction history.

Wallets and payment platforms can reduce risk by flagging dust or zero-value transfers, showing stronger visual differences between addresses, warning about first-time destinations, and requiring additional approval for large transfers. Organizations should also treat address-book changes as security-sensitive events.

What actually happens

Address poisoning is a deception tactic in which an attacker places a lookalike blockchain address in a wallet's activity so the victim later copies it as a destination. Because long addresses are often abbreviated, users may check only the first and last characters. An attacker can generate addresses matching those visible fragments while differing in the middle. The attack exploits human attention and interface design rather than breaking the blockchain's digital signatures.

A poisoner observes a likely payment relationship and sends a tiny transfer, worthless token or fabricated-looking activity involving an address resembling the real counterparty. The wallet history then presents that address as a recent contact. If the payer copies it for a later substantial transfer, a valid network transaction can deliver funds to the attacker. Good wallet software labels trusted saved recipients, shows full addresses and warns when an unfamiliar address merely looks similar to a known one.

Decisions and failure cases

A checksum validates input integrity under certain address encodings, not recipient identity. First-and-last-character matching is unsafe. For high-value transfers, use allowlisted addresses with independent out-of-band verification and approvals for any address changes.

Related concepts

Zero Address, Account Address, Blockchain Transaction Screening.

Further reading

Ethereum account documentation.