Address poisoning attacks have been widely discussed on X (Twitter) recently. The core idea is: don't directly copy addresses from the transaction history. Attackers generate fake addresses with the same prefix and suffix and slip them into the records—it's hard to distinguish with the naked eye. Before every transfer, I verify the first and last few digits one by one, but a safer approach is to save commonly used addresses to a whitelist and send to those instead.