Address Poisoning: Why the Wallet You Just Pasted Might Not Be Yours
The most common way self-custodial users lose funds is not a hack. It is copying a familiar-looking address out of their own transaction history and sending money straight to an attacker. Here is how the scam works and how to never fall for it.
28/06/2026 · 8 min de leitura · self-custody · wallet security · address poisoning · DEX · trading education
The mistake is yours, and that is exactly the point
On a self-custodial exchange there is no support desk that can reverse a transfer. Once your signature broadcasts a withdrawal, the chain executes it and the funds are gone to wherever you pointed them. That is the trade self-custody asks of you: complete control in exchange for complete responsibility. Most attackers know they cannot break your wallet, so they target the one step the wallet cannot check for you, the destination address you type or paste.
Address poisoning is engineered around that single weak point. It does not exploit a bug in your wallet or the chain. It exploits the way humans verify addresses, by glancing at the first and last few characters, and it weaponizes the one place you trust most: your own transaction history. The whole attack is a setup that ends with you confidently sending funds to an address you believe is one you have used before.
How the poison gets into your history
Public addresses are long strings of characters, and almost nobody reads the whole thing. We pattern-match the start and the end, say 0x1a2b at the front and 9f3e at the back, and assume the middle is fine. Attackers generate a vanity address that matches the first and last characters of an address you actually interact with, often the deposit or counterparty address you reuse. Generating a lookalike with matching ends is cheap and automated.
Then they put it where you will find it. In a zero-value or dust transfer, the attacker sends you a tiny or empty transaction from the lookalike address, so it appears in your history as if you had transacted with it. In a more deceptive variant, they push a fake token transfer that mimics a stablecoin you use, making the poisoned address sit right next to your real activity. The next time you go to repeat a transfer and copy the recipient from your history, you grab the address of the attacker instead of the real one. The ends match, so it passes your glance, and you sign.
Why a quick glance is not verification
The core failure is treating the first and last characters as a checksum. They are not. Two addresses can share their visible ends and differ entirely in the middle, and only one of them is yours. The attacker is not trying to fool a machine, which would catch a single wrong character instantly. They are trying to fool the part of you that is busy, repeating a routine action, and pattern-matching instead of reading.
This is why address poisoning hits experienced users as often as beginners. The more transfers you do and the more you rely on muscle memory (copy from history, paste, send), the more exposed you are. Confidence is the vulnerability. The defense is not being smarter; it is refusing to let a routine action skip the one check that matters.
The habits that defend you
Never copy a destination address from your transaction history. History is exactly the surface the attacker poisons. Source addresses from somewhere you control: an address book entry you saved yourself, a QR code from the receiving device, or the official account page of the destination. If the only place you can find an address is your recent activity, stop and find the real source.
Verify the full string, not the ends. Check characters in the middle as well, or better, use the saved-contacts or allowlist feature of your wallet so you select a named entry instead of pasting raw text. For a large transfer to a new destination, send a small test amount first, confirm it arrived at the right place, and only then send the rest. The test costs you a little gas; skipping it can cost you everything.
Extra friction is the feature, not the annoyance
Good security here looks like deliberate slowness. Use an address book so the addresses you reuse are ones you vetted once and named, removing the paste step entirely. Where a human-readable name service is supported, sending to a name you can read is far harder to spoof than a forty-character hex string. Treat every dust transfer or unexpected token that shows up unrequested as suspicious by default, and never use it as a source for a future send.
It also helps to keep the wallet you transact with separate from the wallet you store value in. The trading wallet sees a lot of activity and is the one most likely to get poisoned; the savings wallet signs rarely and reuses a tiny, hand-verified set of destinations. Limiting how often you paste an address at all shrinks the window the attacker is counting on.
Self-custody done right means owning the destination
Address poisoning is a clean illustration of what self-custody really is. No operator stands between your signature and the chain, which is the whole point, and which is also why the destination is yours to get right. The protection is not a feature a venue can switch on for you; it is a habit you carry across every wallet and every chain you touch.
OFFCODE is built on that model: a global, self-custodial DEX where you keep your keys and your trades settle on-chain, including USDC-margined perpetuals. The same discipline applies whether you are funding an account, withdrawing, or paying a counterparty: source the address from somewhere you control, read the whole thing, and test before you trust. Verify the destination, and the most common self-custody loss simply cannot happen to you.