Address poisoning is hitting harder than most realize. Here's the attack vector breakdown:
Scammer sends you a 0 $USDT transfer from an address that mimics yours (same first/last chars). It shows up in your transaction history. You copy it by mistake. Funds gone.
24-hour sampling across four chains (zero-value $USDT/$USDC transfers):
Ethereum: 13.5% of all transfers (≈177k/day)
Base: 2.7%
BNB Chain: 1.1%
Arbitrum: 0.4%
Weird finding: Ethereum's poison rate is 12x higher than BNB Chain, even though BNB Chain gas is 12x cheaper ($0.0008 vs $0.0098). Economics don't explain the distribution.
On BNB Chain, all 40 sampled zero transfers were stranger-sent, textbook poisoning.
Usenix Security 2025 paper: 270M attempts, 17M victims on Ethereum + BNB Chain (2022-2024). At least $83.8M stolen.
Defenses in production:
Binance Security built a detector that maps lookalike addresses to their targets, feeds HashDit's database
Trust Wallet pre-sign checks against known scam addresses (32 chains)
Binance lets you whitelist withdrawal addresses
User-side mitigation:
Never copy from tx history
Use address books or whitelists
Manually verify full address before signing
This isn't a theoretical exploit anymore. It's industrial-scale.
Scammer sends you a 0 $USDT transfer from an address that mimics yours (same first/last chars). It shows up in your transaction history. You copy it by mistake. Funds gone.
24-hour sampling across four chains (zero-value $USDT/$USDC transfers):
Ethereum: 13.5% of all transfers (≈177k/day)
Base: 2.7%
BNB Chain: 1.1%
Arbitrum: 0.4%
Weird finding: Ethereum's poison rate is 12x higher than BNB Chain, even though BNB Chain gas is 12x cheaper ($0.0008 vs $0.0098). Economics don't explain the distribution.
On BNB Chain, all 40 sampled zero transfers were stranger-sent, textbook poisoning.
Usenix Security 2025 paper: 270M attempts, 17M victims on Ethereum + BNB Chain (2022-2024). At least $83.8M stolen.
Defenses in production:
Binance Security built a detector that maps lookalike addresses to their targets, feeds HashDit's database
Trust Wallet pre-sign checks against known scam addresses (32 chains)
Binance lets you whitelist withdrawal addresses
User-side mitigation:
Never copy from tx history
Use address books or whitelists
Manually verify full address before signing
This isn't a theoretical exploit anymore. It's industrial-scale.