Checking only a few characters at the beginning and end after pasting a transfer address can leave you vulnerable to address poisoning. Even if the address appears in your recent transaction history, make sure it’s the address of the person you intended to send funds to.
Address poisoning is a tactic in which an attacker sends a small amount or worthless tokens from an address designed to look like that of someone you regularly transact with, so that the address appears in your transaction history. The goal is to trick you into copying that address from your history the next time you send a transaction. Binance’s official security article also advises checking the entire address, not just the beginning and end.
Before sending, check these three things.
① Where did you get the address?
Don’t reuse an unfamiliar address just because it appeared in your recent transaction history. Use an address you’ve verified directly with the recipient.
② Do the middle characters match too?
Comparing only the shortened address shown on screen can cause you to miss differences. Compare the original you copied with the full address you entered.
③ Did you check it after pasting?
Official guidance also warns about malware that can tamper with clipboard contents. Don’t assume the address you entered is the same just because it was correct right before you copied it.
For addresses you use often, you can verify them and then use your wallet’s address book feature. Check the saved name against the actual destination, and verify the address’s source and the pasted result in order.