Address poisoning explained: the scam that hides in your history

Address poisoning needs no hacking and no signature. The scammer simply makes your transaction history lie to you, then waits for you to copy the wrong address. It works because crypto addresses are long, wallets shorten them, and people copy from the last transaction they made.

How it works

1. 1The scammer watches for an address you send to often, such as your exchange deposit address.
2. 2They generate a new address that starts and ends with the same characters as that one. Matching four characters at each end takes ordinary computers very little time.
3. 3They send you a tiny or zero-value transfer, or a fake token, from the look-alike, so it appears in your history right next to the real one.
4. 4The next time you copy "the address I always use" from your history, you copy theirs. The transfer is final.

Why it works

• Wallets and explorers shorten addresses to something like 0x7f3a…c21a, which is exactly the part the scammer matched.
• Copying from history feels safe because it is an address you have used before.
• Tiny incoming transfers look harmless, so nobody checks where they came from.

How to avoid it

• Never copy an address from your transaction history. Use your wallet's or exchange's address book, saved once and checked carefully.
• Check more than the ends. Compare characters in the middle of the address too, because the start and end are what the scammer copies.
• Send a test amount first to any address you haven't used in a while, and confirm it arrived where you expected.
• Ignore unexpected tiny transfers and unknown tokens. Hide them if your wallet allows it, and never interact with them.

What Fortcore does about it

In Fortcore, receiving money from an address never makes it known, so a look-alike that sent you dust stays a new address. A withdrawal to a new address waits 24 hours while every phone and your email are alerted, the app warns you about look-alike addresses before you sign, and dust is hidden by default.

The limit: small amounts to an address you have already paid through a wait go at once. If you were fooled once and that withdrawal completed, the look-alike is now known, so read your alerts and check new addresses before the first payment.