Address poisoning

The attack has two pieces. First, the attacker brute-forces a vanity address whose first and last characters match the address the victim usually transacts with, since many wallets hide the middle and people verify only the ends. Then they inject that decoy address into the history: through a zero-value transfer, which exploits the fact that an ERC-20 transferFrom allows moving a zero amount without holding tokens or an allowance, or by sending dust or a fake token with the same name. In a later transfer, the victim copies the lookalike address from the history.

Unlike approval phishing, there is no authorization signature here: the damage materializes through a human copy-paste error. The defense is not to copy addresses from the history, to use an address book or allowlist, to verify the full address and not just the prefix and suffix, and to send a small test transfer before moving a meaningful amount. The phenomenon is documented and flagged by MetaMask, Trezor, Ledger and Etherscan, which marks these transactions as suspicious in its explorer.