Address poisoning: the transfer you did not ask for

The mechanism

Wallet interfaces abbreviate addresses: the first few and last few characters, an ellipsis between. People copy addresses out of their transaction history by matching those visible characters. An attacker generates an address that shares the first and last characters with one the victim genuinely transacts with, then sends a zero-value token transfer from it to the victim. The transfer costs almost nothing and does nothing — except appear in the history, looking like the real counterpart.

The loss happens later, when the victim copies the wrong entry. Nothing was hacked. The attack is a bet on how a human reads a hex string.

What the tool examines

The Wallet Exposure Checker examines what has been sent to a public wallet address and which of it is trying to trick the owner. Its centrepiece is address-poisoning detection: incoming zero-value transfers whose sender shares leading and trailing characters with an address the wallet has genuinely interacted with. It also reports unsolicited tokens and dust.

Token approvals are deliberately left to the Token Approval Inspector rather than duplicated here. One tool per question keeps each answer legible; a checker that reported everything would report nothing well.

• Read: the wallet's incoming transfers, from a public chain.
• Inferred: which senders are engineered look-alikes of genuine counterparts.
• Not claimed: intent. An unrecognised contract is reported as unrecognised, not as malicious.

What to do with a finding

Never copy an address from history. Keep a verified address book, and compare the whole string, not its ends, before sending. A poisoning attempt in the history is not itself a compromise — the wallet's keys are untouched — but it is a sign the address is being watched.