Address poisoning: the devil is always in the detail

The Devil Is Always In The Detail

Address poisoning tries to make an attacker’s address look like a familiar recipient. The aim is to influence where you copy your next payment address from.

• An attacker can create a lookalike address and place it in a transaction history through a tiny or zero-value transfer. Similar opening and closing characters can make it easy to mistake for a trusted address.

• The scammer’s address will be very similar to your address; this is where the deception or ‘slight of hand’ comes in.

• The scammer is betting that you’ll copy and paste their similar-looking address from your transaction history and, by mistake, send them some or all of your crypto funds.

What You Can Do

• You can easily avoid this by carefully checking the details of your wallet address before transacting and unwittingly copying and pasting the scammer’s wallet address.

• Never copy and paste wallet addresses from your transaction history.

• A KYT check can add information about an address’s reported risk. It does not establish that the address belongs to your intended recipient: verify the full address through a trusted source.

Note: Just because your wallet/account has been ‘poisoned’ shouldn’t prevent you from using it - you simply need to check the fine details, i.e., the address, very carefully.

What is address poisoning?

It’s a scam that targets all cryptocurrency users by sending a small amount of crypto to your wallet address - usually a near-zero amount.

The purpose is to ensure that this origination address which would have been expertly generated to look similar to your address, will now show up in your transaction history.

To illustrate, let’s say your crypto address is: 0123456789abcdIl0acd; the scammer might have sent you $0.01 using this similar address: 0123456789bcdeIl0acd. The scammer is literally banking on the fact that you, as with most humans, will look only at the beginning and end characters as a quick visual confirmation. You wouldn’t have noticed that the central characters have changed from ‘abcd’ to ‘bcde’.

Now, you want to convert or buy and send more value to your poisoned crypto address and need to get your wallet address to do so - so you go to your transaction history (because it’s easy) and copy and paste what you believe to be the correct address, your address - except it is the scammer’s address, and BOOM! You’ve been scammed.

How did they almost copy my address?

There are myriad open-source tools that allow scammers to generate addresses that closely follow targetted users’ addresses. Tools like Profanity is one such example.

Also, because blockchain ledgers are publicly available, scammers can see which addresses hold the most crypto and target those for bigger pay-days.As per the above example, using a tool like Profanity means a scammer only needs to change the first few or last characters and rely on your lack of diligence to scam you.

Is this affecting all cryptos?

In short, yes. However, scammers like to target users on blockchains where transaction fees are much smaller, allowing them to deploy their scams at scale. Remember: once the genie is out of the bottle, it won’t ever go back in, i.e., you cannot get your funds back once they have been sent.

The bottom line

Act in haste and repent at leisure. Always go slow - especially when transacting with larger sums. Check each and every character of the address you are sending to and if something is off, abort.

The devil is literally in the detail.