What is address poisoning and what can crypto investors do to avoid such attacks

Given that the cryptocurrency sector is still in its early stages of development, the security that governs blockchain technology isn’t as advanced as it could be. As a result, hackers frequently exploit loopholes to prey on inexperienced cryptocurrency investors and traders.

While certain crypto scams can be caught using automated software or on-chain tracers, a relatively new scamming technique known as “address poisoning” conceals itself in such a way that it is practically impossible to detect if one is negligent.

Address poisoning, unlike phishing attacks, upgrade scams, and investment scams, is not as destructive, but it can still eat away at one’s resources. Let’s find out what address poisoning is and how it is carried out.

What is crypto address poisoning?

Address poisoning is a scamming method where malicious actors send the victim some small value of crypto or NFT from an address that shares the first and last few characters with the victim’s address. The scammer then hopes that the victim would mistakenly copy this ‘scam’ address for future transactions, thinking it is their own. This would eventually send funds to the scammer’s address instead of the desired account.

Also Read: What is the social sentiment indicator and how does it affect the price of cryptocurrencies?

Since crypto addresses are a combination of alphanumeric characters that are difficult to remember, hackers generate similar-looking addresses using open-source tools like Profanity to scam the user.

Usually, crypto users do not check their entire string of addresses but only the first and last few letters. Even some crypto exchanges and providers display only the first and last few characters to make it easier to work with. This is the loophole that scammers take advantage of.

So, when one checks their transaction history and copies an address that one believes is theirs by looking at only the first and last four characters but skipping the middle section, one could fall into a hacker’s well-planned trap and end up sending funds to them. This is how address poisoning is carried out.

How to avoid address poisoning?

Address poisoning heavily relies on the user’s carelessness as a user who is lazy or in a hurry is likely to copy the crypto wallet address from the transaction history to transfer funds.

Also Read: Everything you need to know about Trader Joe, one of the largest liquidity providers of Avalanche

The self-explanatory and obvious way to avoid address poisoning is by double-checking your address before making any transaction. These kinds of attacks have been known to take place on Polygon, Binance smart chain, and Tron, since they have relatively lower transaction fees, making it easy for scammers to send small funds cheaply.

However, an address poisoning incident recently occurred on the Ethereum blockchain as well. A couple of weeks ago Arbitrum, an Ethereum layer 2 scaling solution, airdropped ARB tokens in which over 630 wallet addresses were poisoned, resulting in 933,365 loss of ARB tokens.

The hackers swept funds from Arbitrum users who later complained that their ARB tokens had been “auto-claimed” to the hacker’s wallets. In an unexpected twist, it was later revealed that 933,365 tokens were received from a different address whose owner was tagged as “Fake_Phishing18”.

Also Read: What is MakerDAO and why did it remain one of the biggest DeFi protocols in 2022

As per Arbitrum’s blockchain explorer, a user under the pseudonym “Fake_Phishing18” created a malicious ARB token contract. When a user interacted with the said contract, an additional transaction was created which appeared to originate from the victim’s wallet. However, this was a more advanced case of address poisoning in which a hacker paired it with a phishing attack.

According to PeckShield Alert, a blockchain security firm, the hacker converted 933,375 ARB to 713 ETH worth $1.27 million and bridged those tokens to the Ethereum mainnet. Reportedly, two other wallets also stole 105,000 ARB tokens, although it is unclear whether or not they belong to the same hacker.

Conclusion

Blockchain technology offers transparency and traceability of transactions, but it is also vulnerable to scammers who can easily find a large number of addresses from block explorers to carry out address poisoning attacks. The only way to avoid this attack is to always keep a secure copy of your wallet address and not interact with any suspicious smart contracts shared on social media handles or Discord channels.

Also Read: What are crypto order books and how can they be used to predict price changes