Address Poisoning: a simple but powerful crypto scam
Address poisoning is a form of phishing attack that has recently emerged in the cryptocurrency industry. Scammers are constantly looking to reinvent themselves, and this time they’re counting on your lack of vigilance to steal your funds. But what exactly is address poisoning? How does it work? And what steps can you take to avoid falling into this trap? In this article, we’ll explore this insidious attack in detail and provide you with essential recommendations to protect yourself.
Blockchain, Security, DeFi
2023-06-07
Table of contents
What is address poisoning?
As previously mentioned, the success of an address poisoning attack relies on the user's inattention. Fraudsters use a well-calculated tactic by intentionally sending a small amount of cryptocurrency to a specific address in order to poison its history. When the user copies the address of the last transaction, assuming it to be their own, they unwittingly transfer their cryptocurrencies or NFTs to the deceptive address, enabling the attacker to pocket money fraudulently.
How does it work in practice?
Address poisoning involves several well-defined steps. First, hackers search for active addresses using bots to scan the network. They target addresses that carry out frequent transactions, to maximize their chances of success.
Having identified these addresses, they use applications such as "Vanity" to generate addresses similar to those of the victims. The attackers are obviously aware that most of the time, cryptocurrency users simply check the first and last characters of their long and complex address to make sure it's really theirs. To fool the user, when creating the fraudulent address, the attackers will therefore use the same first and last characters, but they will change the middle part, which is often overlooked and forgotten.
- Once the attackers have generated this new malicious address, they send a small amount of cryptocurrency from it to the victim's wallet address. This changes the history of the address, placing the fraudulent transaction at the top of the list, but keeping an identical visual appearance. It is at this point that the security of the user's funds is compromised by address poisoning.
- Finally, all that's left for the crooks to do is wait for users to take the bait. The success of their attack will be achieved when the user copies the most recent address from their history, thinking it's their own, to transfer their funds to that of the malicious actor.
How to prevent Address Poisoning
While there is no way to prevent the receipt of cryptocurrencies from malicious individuals attempting to steal your funds, it is possible to implement methods to protect your assets against this type of attack.
To effectively protect yourself from address poisoning, it's essential to follow these security measures:
1) Fully check and double-check your address before taking any action from your wallet, to ensure its authenticity.
2) Avoid copying addresses from the history when transferring funds. Instead, write down or save the address in a secure place, or use alternative methods such as QR code scanning.
3) Perform a test transaction by sending a small amount of cryptocurrency before sending the full amount. This verifies that the user is receiving the cryptocurrency and that it is not being sent to a fraudulent address.
4) Using an address book, available on most cryptocurrency wallets, is also a good solution. This feature enables you to securely store and manage your addresses or those of your recipients, reducing the risk of copying a fraudulent address.
- 5) Using a hardware wallet disconnected from the Internet, also known as a "cold wallet", offers additional protection against phishing attacks. Although potentially contaminated by address poisoning according to some reports, this type of wallet requires manual verification of each transaction, thus reinforcing the security of funds.
- By following these security measures, users can significantly minimize the risk of address poisoning and protect their cryptoassets.
Conclusion
In conclusion, address poisoning, although relatively less dangerous than other types of attack, can nevertheless prove formidable. If you are reading this article, you are now familiar with this new type of attack. The use of blockchain and, by extension, decentralization, appeals to our responsibility and requires constant vigilance on our part. Transfers of cryptocurrencies or NFTs should, as far as possible, take place in a calm environment, far from stress and haste. To avoid this type of trap, always be focused, take the time to check addresses carefully and implement the rules of good practice, as set out above. These security measures may seem redundant, but they serve above all to protect our assets and prevent the risks associated with address poisoning and other threats.
Finally, the security of our portfolios depends, in part, on our commitment to these security measures, and to keeping abreast of the latest trends and techniques used by cybercriminals.
Check out our recommended article, which has been read by other users interested in this topic: What is a smart contract?
