When making a transfer, many people copy an address they used last time from their transaction history, glance at the first and last few characters, and tap confirm. Address poisoning exploits exactly this habit.

Related asset: $ETH Current price: 2270.29 (24h +0.47%).

■ What is address poisoning?

Attackers first target addresses that frequently send and receive stablecoins on-chain. They then use a program to generate large numbers of addresses and pick out “lookalike addresses” whose first and last few characters match those of an address you use regularly.

Next, the attacker sends a tiny amount—or a token transfer of 0—to you from the lookalike address, making it appear in your transaction history. The next time you copy an address from your history, you might copy the fake one.

■ A few common disguises

Some token contracts allow transfers of 0 tokens. Attackers can exploit this to leave an on-chain record showing “0 tokens transferred from your address,” making it look as though you sent tokens to that address yourself.

Others issue counterfeit tokens with names matching popular stablecoins, and amounts close to what you usually transfer, making the record look more authentic.

■ Why it’s easy to fall for

An address is a long string of characters. An Ethereum address has 40 hexadecimal characters, and most people only check the beginning and the end. It’s not difficult to generate an address with matching first and last few characters, so checking only those leaves you vulnerable.

This scam doesn’t require your private key or for you to sign any authorization. It relies only on you copying an address when making a transfer. Once an on-chain transfer is confirmed, it can’t be reversed, and assets sent to a similar-looking address are basically impossible to recover.

■ How to protect yourself

Save frequently used recipient addresses in your wallet or platform’s address book or withdrawal whitelist, and select them from there each time instead of copying them from your transaction history. Before sending, check the full address, including the characters in the middle.

For a large transfer, send a small amount first, then send the rest after confirming with the recipient that it arrived. Ignore small or zero-value transfers from unknown sources, and don’t save the sender’s address as a frequently used address.

Some wallets and block explorers flag suspicious zero-value transfers or hide them by default. Pay extra attention if you see a warning like this.

■ One last thing

Address poisoning doesn’t exploit a technical vulnerability; it exploits a convenient habit. Replace “copy from transaction history” with “select from the address book,” and take another look at the characters in the middle, and you can avoid it. Don’t make large transfers over public networks, and remember to keep your phone updated.

If you get it, leave a comment. If you don’t, ask away in the comments.