What is address poisoning, and how do I avoid paying the wrong address?
Address poisoning is a scam that tricks you into copying the wrong address yourself: the attacker generates an address whose first and last characters match one you pay often, then sends you a zero-value or dust transaction so it appears in your transfer history. Next time you copy the address from history, you copy the scammer's. The core defence is habit: copy payee addresses only from a trusted source (a message the counterparty confirmed, your own address book), never from transaction history, and after pasting, compare the full string rather than just both ends.
Why checking both ends fails
Generating an address that matches four leading and four trailing characters takes minutes on a consumer GPU — the scam is engineered precisely against the habit of glancing at both ends. The middle dozens of characters are where the difference lives, and that is exactly where nobody looks.
Three habits before you send
① Copy addresses only from a trusted source, never from transfer history. ② After pasting, compare the full string segment by segment against the source (or pin regular payees with your wallet's address-book / allowlist feature). ③ Before a large transfer, send a small test amount and confirm the counterparty actually received it.
As a supporting tool, paste the address into oceanalt.com/en/check: some poisoning addresses are already in community scam databases, and a hit stops you cold. But honestly — poisoning addresses are usually freshly generated, so list screening assists; the habits are the primary defence.
If you already paid one
On-chain transfers are irreversible. What you can do: stop any further payments immediately; report the scam address to your exchange and community scam databases (so the next person gets a hit); keep both addresses and the transaction hash for a police report. Put the scammer's address on a watchlist — if it moves funds into an exchange, your report gains an actionable lead.
Where to start: free address check · API docs · watch an address
Boundary of everything above: a screening "clear" only means no match in the data held, never a safety guarantee; this page is not legal or compliance advice.