Address poisoning exploits a habit rather than a vulnerability. It targets the moment a user copies a destination address from their own transaction history instead of from the original source.
The attack plants a decoy in your history
An attacker generates addresses until one shares the opening and closing characters of an address you have transacted with.
They then send a transaction involving your wallet, often a zero-value or negligible token transfer, purely so their lookalike address appears in your list of recent activity.
Nothing has been compromised. Your keys are untouched, and the only thing that has changed is what your history displays.
Truncated display does the rest
Wallets and explorers abbreviate addresses, showing the first and last few characters with the middle hidden.
Under that display, the decoy is indistinguishable from the genuine address, and it sits next to it in a list ordered by time.
A user sending a repeat payment copies from history, sees the familiar opening and closing characters, and confirms. The funds go to the attacker and cannot be recovered.
Generating a lookalike is cheap
Producing an address with specific leading and trailing characters is a brute-force search, and matching a handful of characters at each end takes very little computation.
Matching the entire address would require finding a private key for someone else's address, which is not feasible. The attack works precisely because nobody checks the entire address.
On chains where transaction fees are low, sending thousands of poisoning transactions costs almost nothing, so the technique is applied indiscriminately.
Variants use tokens that fake the source
Some versions use a token contract written so that its transfer events name an address the victim controls, making the entry look like an outgoing payment from their own wallet.
Others send a token with a name mimicking a legitimate one, so the entry appears to be a routine transfer of a familiar asset.
Both variants exist to make the planted entry look like normal past activity rather than like an unsolicited transfer from a stranger.
The defence is procedural
Destination addresses should come from the recipient or from a saved address book entry, never from transaction history.
Verifying the full string, or at least a stretch from the middle as well as the ends, defeats the character-matching approach entirely.
Sending a small test amount before a large transfer costs a fee and removes the consequence of an error, which is why it remains standard practice for anyone moving significant value.