A friend in Nairobi sent USDC to what she thought was her supplier's wallet. She copied the address from her transaction history like she always did. Three minutes later the tokens were gone, but the supplier never received them. She had sent 800 dollars to a scammer.
The trick is called address poisoning. It works because most people glance at the first few characters of a wallet address and assume the rest is correct. Scammers exploit that habit by sending you a tiny transaction from an address that looks almost identical to one you use often. When you go to send funds later, you see the fake address in your history, copy it, and send your money straight to the attacker.
How the scam works in practice
Wallet addresses on Solana, Ethereum and most other chains are long strings of random-looking characters. A typical Solana address might start with "7Qx3" and end with "8Hm9", with thirty-something characters in between. Nobody reads the whole thing every time.
Scammers use software to generate thousands of addresses until they find one that matches the first four or five characters of an address you have used before. Then they send you a transaction for a fraction of a cent. That fake transaction now sits in your wallet history, and the address looks familiar at first glance.
Next time you want to send funds to the real recipient, you open your wallet, scan the history, see an address that starts with the right characters, and copy it without checking further. The payment goes through, but to the wrong place. By the time you notice, the scammer has already moved the funds and there is no way to reverse the transaction.
Why checking only the start and end is not enough
Some people have learned to check both the beginning and the end of an address. That helps, but it is not foolproof. Scammers now generate addresses that match both the first few and the last few characters. It takes more computing power, but it is possible, and it happens.
The part most people skip is the middle. Those characters in the centre of the address are just as important as the edges, and they are much harder for an attacker to fake. If you make it a habit to check a handful of characters from the middle of the address, you cut the chance of falling for a poisoning attack dramatically.
A simple routine that takes five seconds
When you are about to send crypto, do not copy the address from your transaction history. Go back to the original source: a message from the recipient, an invoice, a website, or wherever you got the address the first time.
If you must use an address from your history, compare it character by character with the original. Do not just glance at the start. Pick three or four characters from the middle of the address and check them one by one. Most wallets let you zoom in or use a larger font. If the address is on a piece of paper or a screen next to you, read it aloud while you look at the version you copied.
For regular payments to the same person or business, save the address in a note on your phone or in a password manager with a label. That way you are not relying on transaction history at all.
What to do if you see a suspicious transaction
If a tiny transaction appears in your wallet from an address you do not recognise, do not panic, but do pay attention. Check whether that address looks similar to one you have used before. If it does, that is a poisoning attempt.
You cannot stop someone from sending you a transaction, but you can mark the address in your wallet or write it down so you remember to avoid it. Some wallet apps let you hide or label transactions. Use that feature if it exists.
Do not reply to the transaction or interact with the address in any way. Just make a note and move on. The scammer is counting on you to forget about it and copy the wrong address later.
How Anyza helps you stay in control
When you use Anyza Finance, you load prepaid credits into your account once and spend them across Market, Club and Events without sending a new transaction every time. That means fewer on-chain payments, fewer addresses in your history, and less surface area for poisoning attacks.
Because Anyza never holds your funds and every sale goes straight to the seller's wallet, you still choose when and where to send crypto. You just do it less often, with more time to double-check each address.
The next time you prepare to send a payment, pause for five seconds. Open the original message or note, compare the middle characters, and only then confirm the transaction. That small habit is the difference between a successful payment and an expensive mistake.
Comments