What is an Address Poisoning attack in crypto?

Address poisoning is an on-chain phishing tactic where attackers generate lookalike vanity addresses sharing the same initial and trailing characters as a victim's wallet or regular counterparty, then send micro-dust transfers to pollute the victim's transaction history.

How do scammers execute lookalike address phishing on Monero?

Attackers use GPU vanity address generators to synthesize 95-character Monero addresses sharing identical prefix (e.g. 888tNk...) and suffix characters, then send micro-dust transactions to bait users into copying the spoofed address from recent transaction logs.

How does XMRScanner protect users from address poisoning?

XMRScanner automatically scans transaction streams for vanity prefix/suffix lookalike patterns and dust spam, automatically isolating them under an active protection filter so users never copy poisoned addresses.

🛡️ On-Chain Phishing Security Guide

Understanding & Preventing Address Poisoning Attacks

Address poisoning is one of the most stealthy and damaging attack vectors in decentralized finance. Learn how attackers generate lookalike addresses to hijack your clipboard, and how XMRScan's automatic filtering keeps your transactions clean.

How the Attack Works (Step-by-Step)

Vanity Address Generation

The scammer uses GPU vanity tools (e.g. monero-vanity) to generate a 95-character address with the same initial and trailing characters as your Monero wallet or regular counterparty.

Real: 888tNkZrPN...5CPgC9

Fake: 888tNk77b1...5CPgC9

Dust Infiltration

The attacker broadcasts an unsolicited micro-nanonero dust output directly to your stealth keys. This pollutes your incoming transaction ledger with the lookalike spoof address!

dust_output(888tNk... -> 888tNk..., 0.000001 XMR)

Clipboard Hijack

When you later copy a recent address from your transaction history to send tokens, you verify only the first and last few characters, inadvertently pasting the scammer's lookalike address.

⚠️ Funds irreversibly sent to scammer!

🛡️

XMRScanner 3-Tier Anti-Poisoning Architecture

Automatic, real-time protection enabled on every address page

1. Vanity Matcher

Calculates 8-character (prefix + suffix) entropy overlaps to instantly identify lookalikes.

2. Automatic Dust Isolation

Hides zero-value transfers and unsolicited micro-dust from your primary transaction list by default.

3. Clipboard Copy-Guard

Triggers an explicit security confirmation warning before copying any address flagged as suspicious.

How to Keep Your Funds Safe (Best Practices)

✓
Never copy addresses from transaction history: Use OpenAlias (e.g. donate.getmonero.org), address books, or QR codes instead of copy-pasting from recent transfers.
✓
Verify middle characters: Always verify characters in the middle of the address, not just the first 4 and last 4 characters.
✓
Whitelist contacts in your wallet: Use hardware wallet address books (e.g. Ledger, Trezor) or wallet contact lists to ensure accurate destinations.
✓
Keep XMRScanner protection active: Leave the "Poisoning & Dust Protection" filter turned ON when inspecting your wallet.