What is address poisoning? When a fake address hides in your wallet history

Address poisoning is a scam that plants a fake address in your wallet history, with the same first and last characters as an address you usually send money to, so that the next time you copy "the usual address" from your history, you copy the thief's. This piece explains how the trick works, how to spot it, and how never to fall for it.

How it works

1. Bots watch the Tron network and see which address you sent money to.
2. They create an address whose first few and last few characters match that one. Making such an address is not hard for a computer.
3. From the fake address they put a worthless transfer into your history: zero USDT, a speck of TRX, or a fake token that is merely called USDT. Now the fake address sits right next to the real one in your history.
4. Most wallets shorten addresses, to something like TQ4u…9xKp, and then the two look identical. The next time you copy from your history, you may pick the fake one, and a blockchain transaction cannot be reversed.

Nobody steals your password in this trick and you open no link; you simply trusted your eyes.

Warning signs

• A zero or tiny transfer you did not expect, often seconds or minutes after a real transaction of yours.
• An address in your history whose start and end match a familiar address exactly, but whose middle is different.
• A token called USDT that did not come from the official contract. See Is this USDT real?

How not to fall for it

1. Never copy an address from your transaction history. Take it from the source: the deposit page of the exchange or account you are paying, or an address book you saved yourself, with names.
2. Check every character, not just the first and last. The middle is exactly where they differ.
3. For a large amount, send a small one first and ask the recipient whether it arrived.
4. Do not react to a zero transfer. No money left you; just never use that address to send.

At Money Harbor

• On the withdrawal page: if you enter an address whose start and end match one you have withdrawn to before but whose middle differs, the page warns you, shows the two addresses side by side, and does not withdraw until you confirm you have checked every character.
• The first withdrawal to any new address is always reviewed before it is sent.
• USDT Check labels a zero transfer as address poisoning, and given a wallet's address it lists the addresses imitating that wallet's counterparties.
• Take your Money Harbor deposit address only from your own account's deposit page.

More on the same subject: I sent USDT but it has not arrived, Is this USDT real? and TRC20, ERC20 and BEP20.

This is educational. It is not investment advice.