Explained: Crypto address poisoning, typosquatting, and zero-click attacks

April 19, 20255 min read

TLDR;

Address poisoning is replacing a genuine crypto address with a similar-looking one

Typosquatting is replacing or interchanging letters in a word to confuse a reader

Zero-click attacks allow malicious actors to drain your wallet without any input from you

If they can�t force you to transfer your crypto to them, they�ll work to have you trust them by masquerading as the real crypto website, your usual withdrawal address, or using a �harmless� software that sits quietly in your phone or PC. Some common ways scammers achieve these three things include crypto address poisoning, typosquatting, and zero-click attacks. Here, we explore the three ways, how they happen, and how to protect yourself.

Ready? Let�s go!

What is address poisoning in crypto?

Simply put, address poisoning is the act of replacing the actual cryptocurrency wallet with a similar address with the hope that the target victim will confuse the real with the fake and send money to the clone.

Mostly, poisoned addresses appear the same on the first and the last few characters, making it easy to trick a crypto user that the two addresses are the same, although one belongs to a threat actor. Let�s look at an example. The real address is �0xd9A4Gynxw1905632GhJiKKLvbNm�. A malicious actor poisons it with his own address �0xd9A7Gynxw1905632GhJlKKLvbNm�. Did you notice the difference? No? Well, the attackers� address replaced �4� and �i� on the actual address with �7� and �l,� respectively.

How do malicious actors poison a crypto address?

First, they must know the target address by scouting the blockchain for frequently used addresses. Next, they generate addresses that closely resemble the target address.

According to blockchain analytics platform Chainalysis:

�Scammers can easily purchase address poisoning toolkits. [...] The toolkits often include software for generating look-alike addresses that mimic those frequently used in a target�s wallet.�

The final part is getting the poisoned address to the target victim. They do this by sending a small, usually negligible, amount of crypto to the target. Now, the look-alike address is in the �recently used addresses� list of the target victim.

Now, they sit and wait for the target to confuse the addresses and send funds to the poisoned address.

How to protect yourself from crypto address poisoning attacks

Double-check the address character by character.

Use an address book.

Use forensic analysis if possible.

Avoid copying addresses from your transaction history.

Where a large transfer is involved, send a small amount as a test transaction before hauling the rest.

What is typosquatting in crypto?

Typosquatting is the act of altering the correct spelling of a word, usually by interchanging the letters or replacing letters with numbers to present the edited word as the original word.

For example, a word like Binance can be presented as �Binnace.� Notice the typosquatted one has a double �N.� A word like Bybit can be changed to �Byblt.� Note that the �i� has been replaced with a �l.�

How is typosquatting used by malicious actors?

Malicious actors use this attack vector by creating fake website URL�s. When genuine users visit these sites, they�re asked to input sensitive information that lead to their wallets being drained. In some cases, scammers attach wallet drainers on these sites to make it easy to siphon funds.

For example, a Binance user may find themselves on the Binnace.com website, whose interface closely resembles the real Binance.com website. When on these phony websites, attackers may install malware into a victim�s device, steal credentials for further misuse, or trick users into approving fradulent transactions.

Note that address poisoning can be considered a form a typosquatting attack.

How to protect yourself against crypto typosquatting attacks

Confirm the domain name before visting a website or providing sensitive information.

Bookmark frequently used crypto and web3 websites.

Investigate whether the site has an updated security certificate.

Trust the security prompts from your web browser. Leading web browsers like Google warn you when visiting a site they think posses a security threat.

What is a crypto zero-click attack?

Zero-click crypto attacks are attacks that enable malicious actors to drain a victim�s crypto wallet without the victim expressely giving the attackers permission by clicking an infected link, installing software, opening attachments, etc.

How do crypto zero-click attacks happen?

Zero-click attacks take advantage of vulnerabilities or weaknesses in genuine programs already installed on a device. These programs include the operating system, messaging applications, and email programs.

Threat actors use these weaknesses to hide malicious code in a legitimate application. When activated, the code can conduct extra tasks such as installing malware and other programs that later drain wallets or steal sensitive information like logins, email addresses, and personal information.

How to protect yourself against crypto zero-click attacks

Use multi-factor authentication (MFA).

Regularly update your software and operating system.

Connect to secure networks and avoid public internet connections.

Track wallet activity for any suspicious activities.

Turn off Bluetooth when not in use, especially in public places.

Conclusion

Crypto address poisoning, typosquatting, and zero-click attacks are among the sophisticated tricks that malicious actors use to steal funds. To be on the safe side, ensure that you double-check addresses, use multifactor authentication, avoid connecting to public networks, bookmark frequently used crypto websites, and keep all your software updated.

Also, be on the lookout for news on the latest tricks used by crypto scammers and hackers.