Address poisoning

The attacker watches the blockchain for wallets that make regular transfers, then generates a vanity address whose first and last characters match one of the victim's usual counterparties. Next, it sends the victim a zero-value token transfer, a fake token or a tiny amount from that address, so the impostor appears in the wallet's recent activity.

The trick works because many people verify only the beginning and end of an address and copy it from their history rather than from a trusted source. It is common on Ethereum, Tron and other networks where stablecoins move cheaply, and large holders are targeted with automated scripts. In 2024 one victim sent wrapped bitcoin worth around 68 million dollars to a poisoned address, although the attacker later returned most of it.

Saving trusted addresses in an address book, checking the full string, sending a small test transfer and ignoring unexpected incoming transfers are simple, effective protections.