Binance warns on address poisoning scam

TLDR

Binance has issued a security alert about a growing address poisoning scam that tricks users into sending crypto to scammer-controlled lookalike wallets.

1. Attackers create near-identical wallet addresses, send tiny transactions, and rely on victims reusing those poisoned addresses from history.
2. The scam exploits human error, not hacked wallets, and affects any chain that displays shortened hexadecimal addresses.
3. Binance urges stricter address verification and use of allowlists to reduce the chance of irreversible misdirected transfers.

Deep Dive

1. How Address Poisoning Works

Binance has warned about an address poisoning scam where attackers do not break into wallets or steal private keys, but instead manipulate what users see in their transaction history.

As described in the alert, scammers generate wallet addresses that closely resemble a genuine counterparty, typically matching the first and last few characters that most interfaces display, then send a tiny or zero-value transaction from that fake address to the victim. When the victim later sends funds and picks a past recipient from history, they may select the poisoned lookalike instead and unknowingly send funds to the scammer.

Because blockchain transfers are irreversible, any payment sent to this fake address is effectively lost once confirmed.

2. Who Is Most At Risk

This scam targets habits, not cryptography. Users who frequently copy and paste addresses from wallet history rather than verifying the full string are particularly exposed.

Chains that use long hexadecimal addresses and abbreviate them in the UI - like BNB Smart Chain and similar networks - are vulnerable to this pattern, and active users with larger balances are more attractive targets. The threat is cross-ecosystem, since the tactic works wherever interfaces shorten addresses and users rely on partial matches.

3. Practical Protection Steps

Binances guidance emphasizes: always confirm the complete recipient address before sending, ideally by pasting from a trusted source rather than selecting blindly from history.

Second, using an address book or allowlist feature on exchanges and wallets can help ensure you only send to pre-verified destinations. Some users also choose to send small test amounts before larger transfers, but the core protection remains strict verification and trusted address management.

Conclusion

Binances warning highlights that one of todays bigger crypto risks is social engineering around familiar tools rather than direct wallet compromise. Address poisoning turns a single careless copy-paste into a permanent loss, across many chains. Strengthening how you verify and store recipient addresses, and watching for wallet UI improvements that reduce reliance on shortened strings, is a practical way to stay ahead of this scam pattern.