Address Poisoning - Webacy Docs

Overview

Address poisoning is a social engineering attack where attackers send small transactions from addresses that look similar to ones you’ve previously interacted with. The goal is to trick you into copying the wrong address when making future transfers.

Address poisoning has caused millions in losses. Always verify the full address, not just the first and last few characters.

How It Works

Monitoring: Attacker watches your transaction history
Address Generation: Creates address with similar start/end characters
Poisoning: Sends tiny transaction (dust) to your wallet
Deception: Fake address appears in your transaction history
Theft: Victim copies poisoned address for next transfer

Example Attack

Your regular recipient:

0x1234...abcd

Poisoned address (looks similar):

0x1234...abce

The attacker generates an address matching the first 4 and last 4 characters, hoping you’ll copy from history without verifying the full address.

Detection Indicators

Tag	Severity	Description
`address_poisoning`	High	Address involved in poisoning attacks

Why It’s Effective

Transaction history UI: Most wallets show truncated addresses
Copy habits: Users often copy from recent transactions
Similar appearance: Human eyes struggle with hex comparison
Low cost: Generating similar addresses is computationally cheap

Vulnerable Scenarios

High Risk

Copying addresses from transaction history
Using auto-complete in wallet apps
Sending large transfers without verification

Lower Risk

Using saved address book entries
Scanning QR codes directly
Verifying full addresses character by character

API Example

# Check if an address has been involved in poisoning
curl -X GET "https://api.webacy.com/addresses/0x123.../poisoning?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "poisoning_detected": true,
  "status": "success",
  "summary": {
    "total_suspicious": 1,
    "high_risk_count": 1
  },
  "suspicious_transactions": [
    {
      "from": "0x1234567890abcdef1234567890abcdef12345678",
      "to": "0x2e5df068f6cF3A1A3e0A70951c685021CB2954C0",
      "tx_hash": "0x79e7b0a45a73b86fe51882d2553355e15bda7bebb6c3e222c09d8fd2f43aa076",
      "similar_to": "0x1234567890abcdef1234567890abcdef12345679",
      "similarity": 0.95,
      "levenshtein": 2,
      "suspicion_score": 0.85,
      "token_name": "USDT",
      "value": "0"
    }
  ]
}

Protection Strategies

Verify full addresses - Check every character, not just start/end
Use address books - Save verified addresses in your wallet
Double-check large transfers - Extra verification for significant amounts
Ignore dust transactions - Don’t interact with unexpected small deposits
Use QR codes - When available, scan rather than copy/paste
Enable address validation - Some wallets can warn about similar addresses

Wallet Best Practices

// Never trust truncated addresses
const isSameAddress = (addr1, addr2) => {
  // Always compare full addresses, case-insensitive
  return addr1.toLowerCase() === addr2.toLowerCase();
};

// Bad: Only checking first/last characters
const badCheck = addr.slice(0,6) === saved.slice(0,6); // DON'T DO THIS

​Overview

​How It Works

​Example Attack

​Detection Indicators

​Why It’s Effective

​Vulnerable Scenarios

​High Risk

​Lower Risk

​API Example

​Protection Strategies

​Wallet Best Practices

Overview

How It Works

Example Attack

Detection Indicators

Why It’s Effective

Vulnerable Scenarios

High Risk

Lower Risk

API Example

Protection Strategies

Wallet Best Practices