Address poisoning is a scam technique that places lookalike addresses into a user’s transaction history or activity feed so they copy the wrong destination later. Attackers exploit truncated address displays and visual similarity, making careful address verification essential before sending funds or interacting with recipients.
How Address Poisoning Works
Address poisoning succeeds by exploiting the way wallets, exchanges, and blockchains present recipient history. Attackers seed a wallet history or recent-activity feed with lookalike addresses, often using the same first and last characters as a legitimate counterparty, so a rushed user later copies the wrong destination.
The technique is persuasive because many interfaces truncate long addresses, which makes visual verification difficult. The scam is not about breaking cryptography, it is about manipulating human selection at the moment a transfer is created.
Because the attack depends on trust in history and visual similarity, it is especially effective when users rely on memory, copy-paste habits, or a familiar past recipient rather than verifying the full address every time. That makes the user interface itself part of the attack surface.
Why It Is Effective in Crypto Workflows
Address poisoning fits naturally into wallet and exchange workflows because users repeatedly send funds to the same counterparties and often depend on recent history to reduce friction. A fake entry that resembles a real recipient can be enough to redirect a later transfer.
This is a form of destination substitution. The attacker does not need to compromise the blockchain, only to create a believable candidate that will later be selected from a crowded activity list or copied from an address book style view.
The strongest versions of the scam are designed to blend in with normal traffic, for example by using addresses that share visible fragments with a real recipient. The more a product hides the full address, the more it rewards superficial checking and the more useful the poison becomes.
Security Implications
Address poisoning creates direct asset-loss risk because a single mistaken transfer can be irreversible. In blockchain systems, the destination is usually final once broadcast, so a mistaken paste or selection can immediately move funds to an attacker-controlled wallet.
It also creates trust risk around transaction history, because users may assume that anything appearing in a recent feed or contact list is safe to reuse. That assumption can be false when the history has been intentionally polluted.
For teams building or reviewing wallet interfaces, the important implication is that confirmation UX matters as much as backend transfer logic. A secure transfer flow should reduce the chance that truncated display, lookalike patterns, or overreliance on history can drive a mistaken send. The OWASP API Security Top 10 is not about wallet copy attacks specifically, but it is a useful reminder that authorization and destination handling errors can become direct abuse paths.
How to Reduce the Chance of Misdelivery
Practically, the safest pattern is to verify the full destination through an out-of-band source before sending, especially for new or high-value recipients. Users should treat any address surfaced only from history, search, or a recent list as untrusted until it is checked against a known-good source.
Products can reduce exposure by making the full address easier to inspect, warning on near matches, and requiring deliberate confirmation when a destination has not been used before. Clearer presentation is more effective than hoping users notice a few changed characters in a long string.
For broader identity and secret-handling hygiene, NHIMG’s Ultimate Guide to Non-Human Identities is useful background on why weak handling of identifiers and tokens creates persistent operational exposure. The same basic lesson applies here: anything that makes selection easier without improving verification can increase loss.
Risk and Threat Considerations
Address poisoning is dangerous because the attack path is simple and the outcome is often irreversible. It turns a normal user habit, reusing a known recipient from history, into a loss event by inserting a believable false destination into the same visual context.
Failure mechanism: The attacker relies on truncated displays, near-identical address fragments, and user trust in recent transaction history to cause a mistaken copy or selection.
Impact: Funds can be sent to an attacker-controlled address with little chance of recovery, especially when the transfer system lacks stronger confirmation cues.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | AGENT-5 — Agent Tool Misuse and Authorization | Shows how deceptive inputs can steer a user or agent to the wrong action. |
| Recommendation — Require explicit destination confirmation before approving any value-transfer action. | ||
| CIS Controls v8 | CIS 5 — Account Management | Protects user and service workflows from misuse of trusted recipient data. |
| Recommendation — Review trusted recipient workflows and remove unsafe reuse paths from transaction flows. | ||
| NIST CSF 2.0 | PR.AC — Identity Management, Authentication and Access Control | Covers controls that ensure only the intended destination or recipient is acted on. |
| Recommendation — Apply stronger confirmation controls before authorizing a transfer to a new destination. | ||
Practitioner Guidance
What to watch for: Watch for any wallet or exchange workflow that encourages reuse of addresses from history without forcing full-destination verification. The more often users rely on partial address visibility, the more attractive address poisoning becomes.
Governance implication: Product owners should treat destination presentation as a security control, not just a usability detail. If the interface makes mistaken selection easy, the organisation inherits the fraud risk even when the underlying ledger is secure.
