GOBLIXO
The trap starts with a familiar-looking record
Address poisoning aims to make a misleading address appear in a wallet's history. MetaMask describes attackers creating a lookalike and sending a negligible-value transaction, hoping the recipient will later copy the wrong address. The attacker does not need a recovery phrase to put a public transaction in front of you.
That means an unfamiliar entry is not, by itself, proof that someone controls your wallet. But reusing its destination can create a new, real loss. The dangerous step is treating a visible history item as a verified instruction for your next payment.
Why matching the edges is not enough
Wallets often shorten long addresses. A user may recognize the beginning and end while never comparing the middle. That shortcut is exactly what a lookalike address can exploit. Familiar visible fragments do not establish that two complete identifiers are identical.
Picture a fictional interface showing ABC…XYZ for two different records. Hidden middle characters could differ. This is a visual teaching example, not a valid address. For a real transfer, reveal the full destination and compare it with a reference obtained independently of the suspicious history entry.
Get the destination from the recipient
Ask the intended recipient to provide current receiving instructions through a trusted channel. If you are receiving into your own wallet, use its receive screen for the selected network. Phantom explains that EVM networks can share an address while still requiring the transfer to use the correct network.
For an exchange deposit, start at the authenticated deposit screen and check the asset, network and any memo or tag. Do not substitute an old history entry because it is easier to copy. The sender should verify the destination record, not merely find a string that looks familiar.
Check again at the final confirmation
Compare the destination after pasting it and again in the final transaction preview. Include the asset, network and amount. A saved contact can reduce repeated copying, but the contact must have been verified when created and still needs review when receiving instructions change.
A hardware signer can provide another checkpoint where the relevant details are supported and displayed. Do not assume that possessing a device replaces reading its screen. If the details you need are not understandable, do not invent confidence from the fact that a confirmation button is available.
If you notice a suspicious history entry
Do not reply to it, follow links attached to it or send a test payment to see who controls it. Identify your trusted destination through the receiving wallet or service. Keep a note of the suspicious record if you need to report a scam through the wallet's official route.
An address-poisoning warning deserves investigation, but its absence does not certify a recipient. Conversely, a warning about a new address does not automatically prove that address is malicious. Detection is one signal; independent verification is the repeatable habit.
If money was already sent to the wrong address
Preserve the transaction identifier, network, actual recipient and the instructions you intended to follow. Contact the relevant wallet or receiving service through official support. Phantom warns that it cannot reverse a transfer or retrieve tokens sent to a wrong address. Do not accept a recovery guarantee from an unsolicited helper.
The prevention routine fits on one line: trusted reference, full address, correct network, final preview. Keep that process separate from the transaction list. History tells you what was recorded; it does not tell you which destination deserves your next payment.
If a copied address changes between the source and the final preview, stop the transfer. Compare the full address again through a trusted route. A visual mismatch is a reason to investigate the copying process, not a reason to approve hurriedly because most characters still look familiar.
