Address Poisoning and Lookalike History
Learn how attackers contaminate transaction history and why partial address checks fail.
Key takeaways
- Do not copy unsolicited history.
- Verify the full address and network.
- Control address-book changes.
Address Poisoning and Lookalike History: the decision context
Attackers send tiny or crafted events from lookalike addresses so they appear in history. Inclusion does not make the sender legitimate.
Truncated displays hide differences beyond matching first and last characters. Compare the entire destination with an independent trusted source.
What evidence deserves attention
Recent history is not an address book. Verify enrollment and modification of saved destinations or withdrawal allowlists.
A repeatable review workflow
Choose a trusted address from the recipient's independent channel, compare every character with the wallet destination, and label it locally. When a lookalike dust transaction appears in history, compare its full address and transaction origin rather than copying the visually similar prefix and suffix.
Limits, failure modes, and risk
A test transfer helps only if the larger transfer reuses the already verified destination. Confirm receipt independently before proceeding.
Clipboard malware can substitute an address after the history check, and Unicode or truncated interfaces can conceal differences. Address allowlists may have delays or compromised administration, while a successful small test does not validate a newly pasted destination for the larger payment.
Frequently asked questions
What is the first thing to distinguish in Address Poisoning and Lookalike History?
Start with this article's central checkpoint: Do not copy unsolicited history. Then verify the definition and scope against the cited sources.
How can I check Address Poisoning and Lookalike History in practice?
Use the worked procedure in the article and keep these two checks together: Verify the full address and network. Control address-book changes.
What is the most important limitation?
Transfers to poisoned addresses are usually irreversible and controlled by the attacker.
How this article was prepared
This educational article was prepared with AI assistance, then reviewed editorially for clarity and checked against the cited source material.