Address Poisoning and the Copy-Paste Attack

This attack requires no exploit, no signature and no malware. It exploits a user interface convention — the truncated address — and a habit almost everyone has, which is copying a destination from recent history rather than from its source.

How it works

The attacker watches the chain for addresses that move meaningful value. When you send funds to your own exchange deposit address or a frequent counterparty, they take note of that address.

They then generate a new address whose first four to six characters and last four to six characters match it. Producing a vanity address with matching ends is computationally cheap — commodity hardware does it in minutes, and the middle of the address, which nobody checks, is left to be whatever it turns out to be.

From that lookalike address they send you something: a zero-value token transfer, a dust amount of a token, or an NFT. It costs almost nothing on a cheap chain, and it does exactly one thing — it puts their address in your transaction history next to the real one.

Later, you go to send funds. You look at recent transactions, see an address that begins 0x7a3f and ends 9c2d, recognise it, copy it, and send. It is not the same address.

Why it succeeds

Three design realities work in the attacker's favour.

Wallets and explorers truncate addresses in the middle, showing the ends. That is the only part users compare, and it is precisely the part the attacker matched.

Transaction history is presented as trustworthy, because it is a record of what happened. It is — but an incoming transfer only proves someone sent you something, not that you have any relationship with them.

And humans verify by pattern. After sending to the same address a dozen times, you recognise its shape rather than reading it, which is exactly the recognition the attack forges.

Variants

Clipboard hijacking, the older malware version: software on your machine replaces a copied address with the attacker's at the moment you paste. Same outcome, different mechanism, and it defeats even careful copying from the correct source.

Fake token transfers that appear to be a legitimate transfer of a real token from a real address, spoofing the token's transfer event so the history entry looks authentic.

Dust with a message, where the incoming transfer carries a website in its metadata leading to a drainer. This is a different attack sharing the same delivery channel, and the correct response is identical: do not interact.

The habits that defeat it

Use an address book. Save each destination once, verified at the source, with a label. Send from saved entries only. This removes the copy-from-history step entirely and is the single most effective fix.

Verify the middle. When you must copy an address, check characters from the middle as well as the ends. Better, verify the whole string — and best of all, verify it on a hardware wallet screen at the moment of signing, which also defeats clipboard hijacking, since the device shows what is actually in the transaction rather than what your computer displays.

Send a test transaction before moving a large amount to a new destination. The cost is a small fee; the alternative is unbounded.

Never interact with unexpected incoming assets. Do not send them back, do not swap them, do not click anything associated with them. Hide or ignore them — good wallets now filter suspected poisoning transfers out of the default history view, which is a feature worth choosing on.

If it has already happened

There is no recovery. The transfer was valid, authorised by you, and to an address the attacker controls. Report the destination address to the exchange if it moves there, but treat the funds as gone.

Then fix the process rather than resolving to be more careful, because the attack is specifically designed to beat carefulness. An address book plus a test transaction plus device verification removes every step where the substitution can occur — which is the same structural approach that works against the rest of the scams catalogued in avoiding crypto scams.