Be Aware of Phishing Addresses¶
Address poisoning puts an address that looks like one you already use into your transaction history, then waits for you to copy it. The defense is short to state and needs practice: verify the full address from a trusted source, never from history.
Who this is for¶
Anyone who has copied a destination from a wallet's recent recipients list, or who sends to the same counterparty more than once.
How the scam works¶
An address is long enough to hide a difference. A Bitgold address is 0x followed by 40 hexadecimal characters, and people compare the first few and the last few. An attacker can generate addresses with a matching start and a matching end; the search is cheap and the collision only has to survive a glance.
The attacker then makes your history show that address. They send a zero-value transfer, or a tiny amount of a token, from the lookalike to your address. Nothing of value moves. The point is the row that now appears in your wallet's activity, labeled with an address whose visible characters match your counterparty's.
Days later you need to send again. You open the history, find the row that looks right, and copy it. The clipboard and the send screen show the same familiar start and end. The middle belongs to the attacker, and the transfer confirms before you look twice.
Related variants exist. A "refund" arrives from a lookalike address, hoping you send it back to the same place. Or the attacker poisons a shared address book by sending from an address that resembles a supplier's. In all of them, the address you are meant to trust was never verified. It was observed.
Warning signs¶
- An incoming transaction you cannot explain, especially a zero-value or tiny one.
- Two entries in your recent recipients that look identical at a glance.
- A counterparty who asks you to confirm an address by reading back the first and last characters.
- An address that arrives by chat, screenshot, or transaction history rather than from your own record.
- A refund or dust payment from an address you do not recognize.
If it happens to you¶
- Do not send anything back to the lookalike address, and do not "return" a dust payment.
- If a transfer confirmed, save the hash and report it. The funds sit at an address you do not control, and a confirmed transfer cannot be reversed.
- Delete the lookalike from your address book and saved recipients. Save the real address once, with a label that names the counterparty.
- Tell the counterparty that their address is being impersonated, using a channel you already had.
- Move remaining funds if you also shared a key or signed something while checking.
Compare the whole address, not the edges
Read the address in groups of four characters, against the copy you wrote down when you first agreed on it: an invoice, a signed message, or the counterparty's own page. If the only copy is in your transaction history, you do not have a source.
Next steps¶
- Common Transfer Phishing Scams and How to Stay Safe — the conversation that sets up the payment.
- Theft Prevention — first response once funds have moved.
- Fake RPC Nodes, Fake Balances — the other way your wallet's display can mislead you.
Self-check¶
- Where is the address of your most frequent counterparty written down?
- Would you notice a difference in the middle of an address, not only at the ends?
- Do you ever copy a destination from your transaction history without checking it elsewhere?
- Can you explain why a zero-value transfer would exist at all?