Spotting Poisoned Deposit Addresses Before You Paste a Transfer

Address poisoning works because most people trust whatever is already on their clipboard. An attacker sends a tiny transfer from an address that looks almost identical to one you have used before, hoping that the next time you copy a destination you grab theirs instead. Nothing is hacked and no password is stolen; the mistake happens in the few seconds between copying an address and confirming a withdrawal. This guide sets out a repeatable check you can run on Binance, OKX, Bybit and Bitget before you paste anything into a withdrawal form. The aim is not to memorise addresses but to build a habit that makes a wrong paste obvious. You will look at where addresses come from, how to compare them properly, what to record so future transfers are safer, and when to stop and re-check rather than push a transaction through.

Why clipboard and chat history are the weak point

An address on a public blockchain is visible to anyone, so an attacker can watch your past activity and craft a lookalike that shares the first and last few characters of an address you already use. Those are the characters most interfaces show you, and they are the ones most people glance at. The poisoned address then gets pushed into your field of view through a small incoming transfer, a spam message, or a comment, and it settles into clipboard history or a chat thread where you will meet it again later.

The practical consequence is that the address you copied yesterday is not automatically the address you should use today. Clipboard contents can be replaced without any visible sign, and a chat log can contain both the real address and a lookalike a few lines apart. Treat every pasted address as unverified input, no matter how familiar it looks, and confirm it against the source you control rather than the source that happens to be open.

Exchange help centres describe deposit and withdrawal address handling in their own words, and the account settings area is where you manage saved addresses. Read those pages once so you know which features your account actually has, then design your routine around them instead of around what you remember from a screenshot.

A three-point check before you paste

Start from the destination side, not the clipboard side. Open the receiving platform or wallet and copy the address directly from the screen that generated it, rather than reusing something you saved earlier. If you must reuse a saved address, open the saved-address list inside your exchange account and copy from there, because that list is tied to your authenticated session and is harder to tamper with than a text file or a chat message.

Compare more than the ends. Read the address in full blocks of characters, left to right, and check the middle section as carefully as the first and last four characters. A lookalike usually matches the visible ends and differs somewhere in the middle, which is exactly the part most people skip. If your wallet or the exchange interface offers a checksum warning or flags a mismatched address format, stop and read the message rather than dismissing it.

Confirm the network as well as the address. The same asset can exist on several networks, and an address that is valid on one may be unusable on another. Check the network selector in the withdrawal form against the network shown where the address came from, and check the exchange help centre for how that asset's networks are labelled. Never let a saved address from an old transfer decide the network for a new one.

What to record so the next transfer is safer

Keep a small private record for each destination you use often: a label you recognise, the network, the full address, and the date you last confirmed it. Store it somewhere that is not a public chat and not a shared document. The point of the record is not to save typing but to give you something stable to compare against when a new address appears claiming to be the same destination.

When you send a test amount, record the transaction identifier and the exact address you used, then confirm on the destination side that the funds arrived before sending more. If the arrival address does not match your record character for character, treat it as a signal to investigate rather than a rounding error. Discard any saved address that you cannot trace back to a source you verified yourself.

For withdrawals, the exchange's own confirmation screens and any address-book feature are the reference points, and the fee page tells you how the platform describes network and processing costs. Note what you were shown so that a later surprise in the confirmation screen stands out as a change worth pausing over.

Stop conditions and common mistakes

Stop the transfer if the pasted address differs from your record in any character, if the network shown does not match the one you expected, if the interface warns about the address format, or if you cannot remember where the address came from. Stopping costs nothing; a confirmed transfer on most networks cannot be reversed by anyone, including the platform's support team.

The most common mistakes are copying from clipboard history instead of the source screen, checking only the first and last characters, reusing an address from a chat message because it arrived from someone you trust, and assuming a small test transfer proves the address is correct when it only proves that one transfer worked. Another frequent error is pasting into a field and then editing part of the address by hand, which invites a typo that no checksum will catch.

If something looks wrong, do not send a second transfer to correct the first. Capture the details, check the help centre for the withdrawal status and the platform's process for reporting an incorrect destination, and follow that process. Keeping a written record of what you saw, when, and which address you intended to use makes any later conversation with support far more useful.

Risk boundary: DeFi Protocols Hub

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Copy the destination address from the screen that generated it, or from the saved-address list inside your account, never from clipboard history or a chat log.
• Read the whole address in blocks, including the middle characters, and compare it against your own written record before confirming.
• Check that the network selected in the withdrawal form matches the network the address came from.
• Send a small test amount first, confirm arrival on the destination side, and keep the transaction identifier with the address you used.
• Stop immediately if any character differs, the network is unclear, or the interface shows an address format warning.
• Record the label, network, full address and confirmation date for every destination you reuse, and delete any entry you cannot trace to a verified source.