Guide · Address risk · · by Stefan Tsezarov
The Address That Looks Like Yours
It starts like yours. It ends like yours. It is not yours.
That is address poisoning.
Someone gets a look-alike address into your transaction history and waits. Later, you open your history, see a familiar-looking line, copy it, and send funds to the wrong place.
No wallet hack. No stolen password. No broken blockchain.
Just one bad copy-and-paste.
Never copy an address from your transaction history.
This guide shows how the trick works, why checking only the beginning and end of an address is exactly what the scammer wants, and how to beat it.
01The trap is in your history
Most people send money to the same few places over and over.
An exchange. A friend. Their own second wallet. A business they use regularly.
Blockchain addresses are public, so attackers can watch those patterns.
Then they create a new address designed to look like one you already use.
The beginning matches.
The ending matches.
The middle is different.
Now the attacker needs to get that address somewhere you'll see it later.
Your transaction history is perfect.
They may send a tiny payment, create a zero-value token transfer, or send a worthless token using a familiar name such as "USDT."
You didn't ask for any of it.
That's the point.
The attacker is not trying to steal from you right now.
They're planting a fake address for later.
02Why checking the ends doesn't work
Wallets and block explorers shorten long addresses because nobody wants to stare at a 42-character string on a phone.
So you might see 0x7a3F…9E2c instead of the full address.
And people naturally check what they can see.
"Yep. Starts with 7a3F."
"Yep. Ends with 9E2c."
"Must be the same address."
That is exactly the trap.
The attacker only needs to make the visible part match.
Generating addresses is cheap and automatic. Software can create huge numbers of candidates until it finds one with the beginning and ending they want.
The middle is where the real difference is.
And the middle is the part nobody checks.
03Three ways the fake can appear
The trick doesn't need your approval or your signature.
A tiny payment
The attacker sends a tiny amount to you.
It appears in your recent activity, right where you might later look for a familiar address.
A zero-value transfer
Some token contracts allow transfers of zero tokens to be recorded on-chain.
That can make your history appear to contain a transfer involving the attacker's look-alike address even though you never initiated it.
A fake token
The attacker sends a worthless token using a familiar name or symbol.
Your wallet may show something that looks like a normal asset.
It's bait.
These transactions don't magically give the attacker control of your wallet.
They are there to make the wrong address look familiar.
04$68 million mistake
This isn't just a theoretical trick.
On 3 May 2024, someone sent 1,155 wrapped bitcoin, worth about $68 million at the time, to a look-alike address.
The address had been made to resemble the intended one and had been planted in the victim's transaction history.
About a week later, after the victim publicly offered the attacker 10% to return the funds, the attacker sent the value back in ETH.
A remarkable recovery.
But don't build your security strategy around getting lucky.
Chainalysis later traced the wider campaign and found more than 80,000 look-alike addresses seeded into transaction histories.
Only a tiny fraction of them ever caught a real payment.
And that's what makes the scam work.
The attacker can plant thousands of traps for very little cost.
They only need one person to copy the wrong address once.
05Five habits that beat it
1. Copy from the original source.
Use the exchange deposit page, the invoice, the recipient, or another trusted source. Not your transaction history.
2. Save frequent addresses.
Your wallet's address book is safer than hunting through old transactions.
3. Compare the whole address.
Not just the first four characters. Not just the last four. Compare all of it.
4. For large transfers, test first.
Send a small amount and have the recipient confirm it arrived through a separate channel. A test only helps when someone actually confirms it.
5. Treat unexpected transfers as noise.
Tiny payments, zero-value transfers, and strange tokens can be bait. Don't interact with them just because they appeared in your wallet.
06Try it yourself
Here are two fictional addresses.
Fictional example · the address you meant
Fictional example · the look-alike
Now shorten both the way a wallet usually does: 0x7a3F…9E2c
Looks identical.
It isn't.
Open Compare two addresses in the scanner and paste one address into each box.
You'll see that they are different, even though the beginning and end match.
That's address poisoning in one screen.
And every character that differs gets exposed.
07What the comparison tool can and can't tell you
The comparison tool answers one question:
Are these two addresses actually the same?
That's it.
It cannot tell you which address is the correct one.
That's important.
If two addresses came from your transaction history, both could be wrong.
The original trusted source is what tells you which address you should use.
The tool also doesn't tell you who owns an address or whether an address has been flagged for risk. That's a different check.
One technical detail: on Ethereum-style addresses, capitalization is part of the checksum, so the comparison tool ignores letter case there. On chains where capitalization matters, it compares characters exactly.
The comparison runs in your browser.
Nothing you paste into it is sent anywhere.
The rule
Copy from the source, not from your history. Compare the whole address, not the ends.
That's it.
A familiar-looking address can still be completely different.
Before you send, make sure the address you copied is the address you actually meant to use.
Both example addresses in this guide are fictional. Do not send funds to either one. This guide is general information, not financial advice.