Transactions · 28 / 86 · 2 min
Address poisoning
Someone sends you a tiny transfer from an address that looks like yours, so the next time you copy from your history you copy theirs.
The start and the end of the address match. The middle is the theft.
A worked case
A tiny transfer appears from an address that looks like the person's own. Next time they copy from history, they copy the lookalike. The large payment lands there. Checking the first and last characters was the habit that failed.
The trick
Addresses are long. People check the first and last characters. The attacker matches those and hides the difference in the middle. The fake transfer sits in your history, waiting for a careless paste.
The habit
Do not copy a destination from transaction history. Copy it from a saved, checked entry, or from the recipient through a channel you already trust.
Check more than the ends of the address on the device that will sign. A small test transfer is cheaper than a large mistake.
The dust that sits in your history
Addresses are long. People check the first characters and the last. An attacker sends a tiny transfer from an address that matches those ends and differs in the middle. The transfer sits in your history. The next time you copy a destination from that history, you copy theirs. The payment is valid. You signed it. The chain will not know you meant your own wallet.
This became common enough on Ethereum that explorers and wallets started warning about it. The defence is dull and complete: do not copy a destination from transaction history. Copy it from an entry you saved and checked, or from the person, through a channel you already trust, and check more than the ends on the device that will sign. A small test transfer is cheaper than a large mistake.
There is no famous single victim who stands for every case, because the theft is quiet and the amounts vary. The shape does not need a celebrity. If the history is where you copy from, you are the case.
Read it yourself
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The address that received the paste.
The attacker, who chose the lookalike.
That payment. The chain will not know you meant someone else.
Check yourself
Is a matching start and end of an address enough?
No. The middle is where the copy hides.
After this you can stop pasting destinations from your history.