Address poisoning: how a fake entry in your history steals your next send

Here is the setup. A scammer scans the chain for wallets that send often. Then they generate an address whose first and last characters match one you already use. From that look alike address they send you a tiny amount, or a fake token. Now their address is sitting in your transaction history, right next to the real ones.

Later you want to send again. You open your history, grab what looks like your usual address and paste it. The opening four characters match, and so do the closing four. The middle is different. Your coins land with the scammer. It is a simple trick, and it still works.

Where you will see it

The attack shows up most on networks where transfers are cheap and stablecoins are popular, like Tron and Ethereum compatible chains. If you move USDT on a regular basis, expect to be targeted sooner or later.

Your defence checklist

• Do not copy addresses out of your transaction history. Pull them from your wallet address book, or copy them fresh from the original source.
• Read the entire address. The start and end are not enough, so check the middle as well.
• When the amount matters, send a small test transaction first.
• Treat zero value transfers and tokens you never requested with suspicion.

Why Swap1337 leaves less room for it

Each swap on Swap1337 comes with its own fresh, single use deposit address, displayed on your swap page along with a QR code. Since a deposit address should never be reused, there is no reason to dig one out of your history. For your receiving address, paste it straight from your wallet receive screen, never from a past transaction. For more habits like this, read how clipboard malware works and how to beat it.

Quick answers