Address Poisoning

Overview

Address Poisoning is a scam in which an attacker inserts a lookalike wallet address into a victim’s transaction history, often by sending a tiny or zero-value transfer. Its operational purpose is to trick a user into copying the attacker’s address when making a later payment. It should be considered alongside Address Validation. The relevant distinction is ordinary address validation, which checks format and network compatibility but does not prove that the destination belongs to the intended recipient.

A typical workflow is as follows: An attacker observes a frequently used address, generates a visually similar address, and sends a dust or zero-value transaction. The victim later copies the recent-history entry instead of retrieving the trusted destination from an approved source.

Core controls include full-address comparison, address books, allowlisting, out-of-band confirmation, hardware-wallet display checks, transaction simulation, and warnings for first-time or lookalike destinations.

In payment and crypto operations, merchant payouts, treasury transfers, and refunds, the destination should come from a controlled beneficiary record rather than browser history or a block explorer. High-value transfers should require dual approval and a test transaction when operationally appropriate. Messages should state the result without overstating what it proves.

Evidence should include the original beneficiary instruction, approved address record, comparison result, warning shown, approver identities, transaction hash, asset, network, amount, and incident response actions. Because blockchain transfers may be irreversible, one copied-character mistake can produce a direct loss even though the wallet and network functioned correctly.

A production treatment of Address Poisoning should test a scam in which an attacker inserts a lookalike wallet address into a victim’s transaction history, often by sending a tiny or zero-value transfer within the relevant asset, decision, or service state. The Address Poisoning context record for often by sending a tiny, and zero-value transfer should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Address Poisoning should determine whether safeguards addressing often by sending a tiny, and zero-value transfer changed exposure in practice, not merely whether a document or setting existed.