Address poisoning: the fake address in your own transaction history
Attackers plant a near-identical address in your transaction history and hope you copy it. Here's how it works, and how to protect yourself.
You regularly send crypto to the same address, say your exchange or your cold wallet. For convenience, you copy the address from your transaction history. Address poisoning relies on exactly that habit.
How it works
- The attacker watches the public blockchain to see which addresses you send funds to.
- They generate their own address that starts and ends with the same characters as one of yours. With enough computing power, matching a handful of characters takes little time.
- From that look-alike address they send you a zero-value transaction, a few cents, or a fake token. Now the fake address shows up neatly in your own history.
- The next time you copy the address from your history, you grab the wrong one. Many wallets only show the beginning and end of an address, so the difference doesn't stand out.
A blockchain transaction is irreversible. Once the money is sent, in practice you won't get it back.
How to protect yourself
- Never copy an address from your transaction history. Use a saved address book in your wallet, or take the address fresh from the source each time, such as your exchange's deposit page or your hardware wallet's screen.
- Check the whole address, not just the start and end. Compare a few characters in the middle too.
- Set up a withdrawal whitelist on your exchange. Withdrawals then only go to addresses you consciously approved earlier, often with a waiting period for new ones.
- Send a small test transaction first for larger amounts to a new or rarely used address.
- Verify the address on your hardware wallet's screen before confirming. Malware on your computer can't alter that screen.
- Ignore unknown tokens and zero-value transactions in your history. Don't interact with them, and don't visit websites mentioned in the token name.
The bigger picture
Address poisoning isn't a hack of your wallet. It abuses a habit. That's true of much modern crypto fraud: the technology is secure, the process around it isn't. A fixed sending routine, with an address book, full verification and a test amount, protects you against this and similar tricks.
Want to know how securely your wallets and habits are set up? A wallet security check maps it out.