Address poisoning places misleading addresses in transaction history to encourage a mistaken transfer. Verify destinations from trusted sources and inspect the full address.
Address poisoning targets the way people choose a destination. An attacker introduces a lookalike address into visible activity, hoping it will later be copied as a familiar recipient. The attack relies on a mistaken future authorization rather than ownership of the intended address.
What Address Poisoning Means
A poisoned history contains activity designed to make an attacker-controlled address look relevant or familiar. The beginning and end may resemble a genuine destination while the middle differs. A truncated display can hide the difference that determines where a transfer goes.
Receiving an unexpected entry does not establish that the wallet’s signing keys have been stolen. It creates a misleading source of destination information. That distinction helps separate address poisoning from a compromised key or an unauthorized spending approval.
The central failure is trusting a destination because it appears near legitimate activity. A transaction list records what happened on a network; it is not an authenticated address book of people or services you intend to pay.
Check the complete destination address against a trusted source before authorizing a transfer.
How Misleading History Appears
Attackers exploit the gap between a full address and the short label displayed in a wallet. The exact transaction technique varies with the network and interface.
Lookalike Destinations
A lookalike can share visible characters with an address used before. If the interface shows only those characters, two different destinations may appear nearly identical. The full address remains the relevant identifier, regardless of the displayed nickname or amount.
There is no need for a recipient to request a transaction before receiving visible network activity. Publicly observable addresses can therefore acquire entries that were not initiated by their owner and should not be used as trusted contact records.
Why Partial Checks Fail
Comparing only the first and last few characters can miss the very difference an attacker selected. Clipboard use reduces typing mistakes but does not validate the copied source. A perfectly pasted address can still be the wrong destination.
Saved recipients can be helpful when established through a trusted process. They also need review when account details change. Treat transaction history as evidence to inspect, and a verified recipient record as the source for a new transfer.
A familiar-looking destination is still a separate address until verified.
Where the Actual Risk Arises
The harmful step is authorizing a transfer to the unintended address. Once that transfer is processed, recovery may depend on circumstances beyond the sender’s control. A wallet warning should prompt verification, not a quick dismissal to finish the task.
Small or zero-value entries can be easy to overlook, but their amount is not the decisive issue. What matters is whether an unfamiliar address is being presented in a way that encourages it to be reused as a trusted destination.
Do not respond by interacting with unsolicited tokens or visiting links embedded in their names. Those can introduce a different phishing or approval risk. Investigating an entry should begin with public records and the wallet’s verified help material.
Practical Signs to Examine
Look for unexplained activity near a legitimate transfer, especially where the displayed address resembles a known recipient. Compare the full values rather than assuming a familiar prefix and suffix establish identity.
Reconfirm a destination through the receiving service’s current deposit page or an established communication channel. A direct message offering recovery help is not a substitute for the original service’s verified support process.
If a transaction was already sent to the wrong address, retain its public identifier and seek the relevant service’s official guidance. Avoid repeated transfers or disclosure of recovery phrases to anyone claiming that those details are needed to investigate.
Related Concepts
FAQs about Address Poisoning
Does an unexpected transfer mean my keys are compromised?
Not by itself. Address poisoning can add misleading activity without obtaining your keys. Separately inspect any unexplained outgoing authorizations or approvals. The important immediate check is that future destinations come from a verified source rather than copied transaction history.
