Install Chain Insights
← All stories

Safety Academy · Story 02 · Address poisoning

Right name. Wrong address.

A supplier to pay. A familiar-looking address.
One very cheap attempt at an expensive mistake.

Estimated 5 min read

THE 500 USDC SHORTCUT6 scenes

The coffee bill is completely ordinary.

Penny owes her café’s bean supplier 500 USDC on Base. She paid a 50 USDC deposit yesterday. To find the address again, she opens her wallet’s “View on explorer” link.

Penny
“Same supplier. Same beans. Surely this can be a two-click job.”
Illustration: The coffee bill is completely ordinary.

The earlier payment reached the supplier. It does not make every similar-looking address in her history safe.

The scammer spends almost nothing.

Her transfer is public. The scammer creates an address with matching first and last characters, then sends Penny 0.001 USDC from it. That puts his lookalike into her transfer history.

The Scammer
“My customer-acquisition budget is extremely disciplined.”
Illustration: The scammer spends almost nothing.

One row is money received from a stranger. The other is her payment to the supplier. Shortened addresses make different destinations look alike.

Two matching ends. One wrong recipient.

Penny opens the newest row and copies its sender address. She pastes it into a new 500 USDC payment. At the wallet’s review screen, her finger pauses above Confirm.

Penny
“Starts right. Ends right. That’s the whole address… except most of it.”
Illustration: Two matching ends. One wrong recipient.

The pasted address belongs to the stranger who sent the tiny transfer. The wallet is preparing the payment Penny requested, not proving who owns that address.

“You skipped the part where he lives.”

Captain Harold compares the complete pasted address with the supplier’s previously verified address. The ends match. The characters between them do not.

Captain Harold
“Same wrapping. Different pocket.”
Illustration: “You skipped the part where he lives.”

This is address poisoning: a lookalike transfer planted to become your next payment destination. No stolen password is needed if you send to the wrong address.

Penny uses a contact, not a coincidence.

She cancels the pending payment. Then she calls her supplier using the number she already has and confirms the full address and Base network. She starts again from that verified recipient.

Penny
“I am calling the person who supplies the beans. Revolutionary, I know.”
Illustration: Penny uses a contact, not a coincidence.

Use a trusted source independent of the suspicious transfer. A name or familiar-looking address alone is not confirmation.

The supplier gets paid. The scammer gets a lesson.

Penny rechecks the new payment and sends 500 USDC to her confirmed supplier. The scammer’s enormous money bag remains empty. His 0.001 USDC bait has achieved nothing.

The Scammer
“I demand a refund on my marketing campaign.”
Illustration: The supplier gets paid. The scammer gets a lesson.

Copying from history felt quick. Checking the complete address kept the real payment out of the scammer’s pocket.

The useful bit

Your history is not your address book.

  1. Take the address from the person you are paying, or from a contact you already trust. Never from your transaction history.
  2. Compare the whole address, every character, and check the network. The first and last few characters are not enough.
  3. Anything different? Cancel, and ask the recipient through another channel before paying again.

I already did this

If you sent to the lookalike, save the transaction details and contact official support or authorities independently. A wallet cannot reverse a completed transfer. Do not pay a stranger to recover it; the FBI guide explains what to report.

Sources & further reading