A feed of lookalike addresses that poisoning bots plant in wallet histories on Base, flagged in the block the bait lands. Screen payouts, withdrawals and sends against it before money moves.
Address poisoning targets the moment someone copies a recipient from their transaction history. A bot generates an address that shares the first and last four characters with a real counterparty, then plants a fake transfer next to the real one: a zero-value transfer or a worthless token named like USDC. The next copy-paste sends real money to the attacker, and an on-chain payment can't be pulled back. Customer-supplied withdrawal addresses, recurring payouts and the gap between a test payment and the real one are where it hits businesses.
A real case from October: a Base user paid a regular counterparty 1,442 USDC. Within five minutes a bot planted fake copies of that payment, sent to addresses that matched the counterparty's first and last characters, and refreshed them daily. Our watcher flagged the lookalike that was later paid 29 minutes after the real payment. On October 16 the user copied the wrong address from their history and sent it $1,958 in USDC, 6.5 days after our flag. Any send screen that checked the recipient against our feed would have seen it.
Warn before a send to a flagged lookalike, and hide bait transfers from the activity list.
Screen payout, refund and payroll destinations before a batch settles, and on every address change.
Check withdrawal destinations against the feed as one more policy input next to your allowlists.
Add address poisoning as a label class. Public scam lists barely cover it.
Every lookalike flagged in the previous UTC day, as CSV and JSON, plus the full history since September 23, 2026 at the start and the list of addresses we corrected by hand.
For teams that screen at send time, an authenticated endpoint that returns new flags as the watcher sees them. Not self-serve: ask us and we set it up with you.
Each row is one flagged lookalike:
| Field | Meaning |
|---|---|
address | the flagged lookalike address |
first_seen | UTC time of the block where we first flagged it |
hits | how many blocks carried a poisoning transfer involving it |
token_symbol | symbol of the token in the first bait transfer (fakes copy USDC, USDT and others) |
kind | zero_value_transfer or fake_token_transfer |
Lookalike addresses only. The feed never contains the people who were targeted.
The three payments are examples, not a statistic, and no wallet used our data at the time: they could have been prevented, they weren't. Method and limits are in the October 2026 report.
Already have payout or hot-wallet addresses on Base? Send us the public ones and we'll count how many lookalikes of them we have flagged. Or get a free daily e-mail whenever a new one is flagged: Verdix Watch.
CSV and JSON with the fields above, one file per UTC day, plus the list of corrected addresses. The real-time API, available on request, returns the same fields as JSON.
Base mainnet only, for now, from September 23, 2026. If you need another EVM chain, tell us which.
No. It lists lookalike addresses only. Targeted wallets, transaction hashes that name them and payments from them are never delivered.
For every wallet, we keep the counterparties it really exchanged 1 USD or more of USDC or USDT with in the last 7 days. When a zero-value or fake-token transfer links that wallet to an address that matches one of those counterparties on the first and last four characters but isn't it, the address is flagged in that block. We read every token transfer on Base ourselves; no explorer labels or third-party lists are used.
Email us an address you think is wrong. We check it on-chain, and if it's a mistake we clear it: it disappears from lookups at once and goes on the corrected list delivered with the feed. Rows that could be ambiguous (contracts, addresses with their own transactions or a balance) are dropped from the delivered feed before you see them.
Only address poisoning on Base. It doesn't check sanctions or other scam types, and it can't see lookalikes of native ETH payments or of counterparties we haven't seen paid. All counts are lower bounds.
Yes, for free: the poisoning checker.
Tell us what you'd screen (payouts, withdrawals, wallet sends) and roughly how many addresses a day.
Email lauras@verdixapi.com