Address poisoning is a scam that requires no access to your keys and exploits nothing more than copy-and-paste habits. It survives because of how wallet software displays long strings, not because of any flaw in the chain.
The attack plants a lookalike entry in your own history
An attacker generates an address whose first and last characters match one you have recently paid, then sends a transfer of negligible value from it to you.
That transfer now sits in your activity list beside genuine ones. Nothing has been taken and no permission has been granted; the entry itself is the entire payload.
The next time you pay that counterparty, the poisoned line is waiting in the same list you would normally copy from.
Truncated display is what makes it viable
Addresses are long enough that almost every interface abbreviates them, showing a few leading and trailing characters with the middle replaced by an ellipsis.
Users learn to verify by those visible ends because that is all the interface offers. The attacker therefore only has to match the part that is shown.
Searching for an address with matching ends is brute force, but the search is cheap compared with the size of the payments being targeted.
The bait costs the attacker almost nothing
On low-fee chains a dusting transfer costs a fraction of a cent, so the same lookalike can be sprayed at thousands of addresses at once.
Some variants avoid moving value at all by emitting a transfer event for a worthless token, which many interfaces will still render as incoming activity.
Habit is the real vulnerability
People who transact often stop reading addresses in full because they have typed or checked them before and the string carries no meaning.
Recency makes it worse. The poisoned entry is usually the newest one matching a search, so it surfaces first when the user scrolls back for the address they used last week.
What actually defeats it
Saved address books break the loop, because the payment destination comes from a record you created deliberately rather than from a list an outsider can write to.
Verifying the middle of the address matters more than verifying the ends, since the ends are the part the attacker matched on purpose.
For an unfamiliar or large payment, sending a small amount first and confirming receipt costs one extra fee and removes the guesswork entirely.