Attackers generate a look-alike from your history and wait for you to copy the wrong row.

Skip to content
Chain188

Address poisoning and the one habit that stops it

Attackers generate a look-alike from your history and wait for you to copy the wrong row.

Filed in Verified October 27, 2026 1 min read
Address poisoning and the one habit that stops it
In this article · 3 sections
  1. How the trick works
  2. The one habit
  3. Why it keeps working

TL;DR

Attackers generate a look-alike from your history and wait for you to copy the wrong row.

Key takeaways

  • Verify against a saved entry, not history.
  • Send a small test first.
  • Hide or ignore unsolicited transfers.
Verified October 27, 2026 1 min read

Address poisoning and the one habit that stops it

How the trick works

The attacker sends a tiny transfer to your address from a wallet they generated to look like a counterparty you already use. That puts the look-alike in your history. Later, when you copy an address from the history list instead of your address book, the funds go to the attacker.

The one habit

Verify the destination against a saved address book entry, and check more than the first and last four characters — or better, use a wallet that resolves a name. For a new counterparty, send a small test amount first.

Control Effect
Saved address book Defeats the look-alike entirely
Full-string check Catches the swap
Test transaction Caps the loss

Why it keeps working

Because the interface compresses information under time pressure. The defence is procedural, not technical, which is why a single habit is worth more than another scanner.

How we verify

Chain188

Every offer is re-checked against the official terms page, the bonus amount and the expiry date before it is published, and again whenever a campaign changes.

Last verified October 27, 2026 Text-only version Corrections

Frequently asked questions

Can a poisoned address steal funds directly?

No. It has to be copied and used by you. The attack is social, not cryptographic.

Why do the first and last characters match?

Because interfaces truncate addresses, so those are the characters a user can see. Matching them is enough to fool a quick glance.

0 comments

No comments yet — ask a question and we will answer it here.

Leave a reply

Daily digest

Get today's best crypto offers

One short email each morning with the offers that changed overnight.

No spam, unsubscribe in one click. We never share your address with the brands we review.