Address Poisoning

Overview

How It Works

1. Monitoring: Attacker watches your transaction history
2. Address Generation: Creates address with similar start/end characters
3. Poisoning: Sends tiny transaction (dust) to your wallet
4. Deception: Fake address appears in your transaction history
5. Theft: Victim copies poisoned address for next transfer

Example Attack

0x1234...abcd

0x1234...abce

Detection Indicators

Why It’s Effective

• Transaction history UI: Most wallets show truncated addresses
• Copy habits: Users often copy from recent transactions
• Similar appearance: Human eyes struggle with hex comparison
• Low cost: Generating similar addresses is computationally cheap

Vulnerable Scenarios

High Risk

• Copying addresses from transaction history
• Using auto-complete in wallet apps
• Sending large transfers without verification

Lower Risk

• Using saved address book entries
• Scanning QR codes directly
• Verifying full addresses character by character

API Example

# Check if an address has been involved in poisoning
curl -X GET "https://api.webacy.com/addresses/0x123.../poisoning?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

{
  "poisoning_detected": true,
  "status": "success",
  "summary": {
    "total_suspicious": 1,
    "high_risk_count": 1
  },
  "suspicious_transactions": [
    {
      "from": "0x1234567890abcdef1234567890abcdef12345678",
      "to": "0x2e5df068f6cF3A1A3e0A70951c685021CB2954C0",
      "tx_hash": "0x79e7b0a45a73b86fe51882d2553355e15bda7bebb6c3e222c09d8fd2f43aa076",
      "similar_to": "0x1234567890abcdef1234567890abcdef12345679",
      "similarity": 0.95,
      "levenshtein": 2,
      "suspicion_score": 0.85,
      "token_name": "USDT",
      "value": "0"
    }
  ]
}

Protection Strategies

1. Verify full addresses - Check every character, not just start/end
2. Use address books - Save verified addresses in your wallet
3. Double-check large transfers - Extra verification for significant amounts
4. Ignore dust transactions - Don’t interact with unexpected small deposits
5. Use QR codes - When available, scan rather than copy/paste
6. Enable address validation - Some wallets can warn about similar addresses

Wallet Best Practices

// Never trust truncated addresses
const isSameAddress = (addr1, addr2) => {
  // Always compare full addresses, case-insensitive
  return addr1.toLowerCase() === addr2.toLowerCase();
};

// Bad: Only checking first/last characters
const badCheck = addr.slice(0,6) === saved.slice(0,6); // DON'T DO THIS