Source: Obiex's Blog

In cryptocurrency, address poisoning refers to a cybersecurity threat or attack that scammers use to infiltrate people’s wallets. It involves manipulating people’s addresses with dummy or duplicated transactions.

Different Scenarios of Address Poisoning:

In the context of cryptocurrency, address poisoning could potentially refer to the alteration of payment addresses in transactions. For instance, attackers might attempt to modify a recipient's wallet address during a transaction to divert funds to a different address controlled by the attacker.

Scenario 1

A scammer or bad actor may modify a recipient’s address in a transaction. For example, during a transaction, an attacker may try to change the recipient's wallet address to transfer funds to a very similar address under their control.

While the main token is received by the intended recipient, a duplicate transaction may be shown in the transaction history and it would seem like the sender sent the token twice. The receiving addresses for both transactions (duplicate and real) may seem very similar (may have the first and last digits the same) but a closer look at the middle digits of both addresses will show the differences in the two addresses.

While this duplicate transaction might cause no harm at the time it happened, it can be implicating some other time. Say the sender wishes to send a token to that same receiver some other time and he/she doesn’t check the wallet address carefully (keeping in mind that he/she already has the receiver’s address in his transaction history) and sends the token there, the fake duplicated address might be the address receiving the funds this time around.

Also in a case whereby the the sender wishes to send multiple tokens (or the same token) multiple times to the same receiver, he/she might, unknowingly, copy the recent address (which is the fake address) and send the tokens there.

Here is a tale of how this scenario 1 can happen, a DeFi researcher and storyteller shares her story:

LINK TO TWEET https://x.com/marablossom/status/1762053415331381428?s=20

Scenario 2

A similar scenario might be a scammer creating a very similar address from a vanity address generator, and then sending a very insignificant amount of token/NFT to its target address. The target address owner recognising the first and last digits of this address may send funds to it without checking the middle digits of the address to verify.

Reasons why wallet poisoning happens:

Truncation of wallet addresses: the good ol’ regular wallet addresses are always truncated due to their length, so the only parts visible to people are the first (say 6 or 8) characters and the last (say 5 or 6) characters. To view the full address, one will have to open it up, many crypto traders don’t have the time for that, hence, they just verify the first and the last digits and go on to transact.

Addresses too long: wallet addresses are too lengthy, and checking to verify each character can be stressful (yet necessary).

Metamask even published a thread about wallet poisoning back in January 2023, warning users about the dangers while educating them on measures to take.

Measures to take:

~ The crypto space, as rewarding as it can be, it’s also a very crazy space. The money you’re working hard to make, another person is working hard to take. Better be safe than sorry, it is advisable to always cross-check the wallet addresses you’re sending tokens to and receiving from.

~ Use of domain names which can also serve as wallet addresses. For instance, it’s much easier to check if julia.eth is accurate than to check Ox27fV…………t603.