Address poisoning: how lookalike addresses in your history can hijack an exchange withdrawal

One of the quieter scams in crypto does not involve phishing emails or fake apps. Instead, an attacker watches the blockchain for addresses you interact with, generates a new address that starts and ends with the same characters, and sends a tiny transfer from it so that it appears in your wallet history. Later, when you want to withdraw from an exchange to your own wallet, you open your history, see an address that looks familiar and copy it. The funds go to the attacker. This is known as address poisoning, and it relies on the habit of checking only the first and last few characters. This guide explains how the scheme works and which habits on Binance, OKX, Bybit or Bitget make it harmless.

Why the lookalike works

Blockchain addresses are long strings that nobody reads in full. Most people glance at the beginning and the end, and many wallets abbreviate the middle in their interface. An attacker can cheaply generate addresses that match those visible parts. The tiny incoming transfer, sometimes of a worthless token or a near-zero amount, places the fake address in your history right next to the real one. Nothing has been stolen at that point, which is why many users ignore it. The danger comes only when you copy from that history later.

Never copy a destination from transaction history

The single most effective rule is to stop using history as an address book. When you need your wallet's address, open the wallet itself and use its receive screen for the right network. When you withdraw to a regular destination, select it from a saved entry in the exchange's address book rather than pasting it. If you notice unexpected tiny transfers or unknown tokens arriving, treat them as a warning that someone is targeting your address and be extra careful with the next withdrawal.

Use saved addresses and allowlists on the exchange

Binance, OKX, Bybit and Bitget all let you save withdrawal addresses with labels, and most offer an allowlist or similar setting that restricts withdrawals to saved entries. Add each address once, carefully, by copying from the wallet's receive screen and verifying it with a small test transfer. Label it clearly with the wallet name and network. With the allowlist on, a pasted lookalike cannot be used without first going through the address-adding process, which usually requires extra confirmation.

Check more of the address when it matters

For a new destination or a large withdrawal, compare a longer section of the address, including characters from the middle, between the wallet and the exchange form. Some hardware wallets show the full address on their own screen for exactly this reason. Take that extra minute. Also keep your devices free of clipboard-hijacking malware by installing software only from trusted sources, because such malware performs a similar substitution automatically.

Risk boundary: Russia Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Take destination addresses from the wallet's receive screen, never from transaction history.
• Treat unexpected tiny incoming transfers as a sign that your address is being targeted.
• Save each withdrawal address once with a clear label and turn on the exchange allowlist.
• Compare characters from the middle of the address as well before large or new withdrawals.