Binance warns on address poisoning scam

TLDR

Binance has issued a security alert about address poisoning scams that trick users into sending crypto to lookalike wallet addresses by exploiting copy-paste habits.

1. Address poisoning does not hack your wallet; it poisons your transaction history with a fake lookalike address.
2. The scam preys on users who rely on shortened address views and past transactions, making losses irreversible on-chain.
3. You can reduce risk by verifying full addresses, using trusted allowlists, and treating unexpected tiny incoming transactions as a red flag.

Deep Dive

1. How Address Poisoning Works

In an address poisoning scam, the attacker generates a wallet address that closely resembles one you actually use, often matching the first and last characters that wallets display. They then send a tiny or even zero-value transaction from that fake address to your wallet so it appears in your recent history.

Later, when you send funds and pick a familiar address from your history instead of pasting a verified one, you may accidentally choose the attackers lookalike and send funds directly to them. Binances recent alert describes this pattern and warns that it has been seen on multiple networks, including BNB Smart Chain, that use long hexadecimal addresses abbreviated in wallets.

2. Why This Scam Is So Dangerous

Address poisoning requires no private key theft and no direct wallet compromise. It works purely because many users trust the shortened address preview and their own transaction history.

Once you send funds to the wrong address, blockchain rules make the transfer effectively irreversible, so recovery is unlikely. That makes active users with larger balances and frequent transfers particularly attractive targets. The technique also overlaps with clipboard-hijacking malware that silently swaps a pasted address, increasing the overall surface for similar errors.

3. Practical Defenses For Users

The safest habits focus on verification, not just tools:

1. Always verify the full recipient address against a trusted source before sending, rather than relying on history or a shortened preview.
2. Use an address book or withdrawal whitelist on exchanges and wallets, so you only send to pre-verified addresses.
3. Treat unexpected tiny incoming transactions from unknown addresses as a warning sign and double-check any similar address before you reuse it.

Avoid ever sharing seed phrases or private keys, and be skeptical of any site, app, or support contact that asks for them.

Conclusion

Binances warning highlights that modern crypto scams increasingly exploit user behavior and interface shortcuts, not just technical exploits. By slowing down, verifying full addresses, and relying on trusted allowlists instead of past transactions, you can sharply reduce the risk that an address poisoning scam turns a single copy-paste mistake into a permanent loss.