Address poisoning for businesses: screening payouts and withdrawals

A business pays many counterparties, again and again. That makes its wallets exactly what poisoning bots look for.

Where it hits a business

Customer-supplied withdrawal addresses. A user copies their own address from their wallet history to paste into your withdrawal form, and the history has been poisoned.
Recurring payouts and payroll. Bots watch who a business pays regularly and plant lookalikes of those recipients. An operator who copies the address from the last payout pays the attacker.
Test payment, then the real one. Teams often send a small test first. A lookalike can appear in the history between the two, and the real payment goes to the copy.
Treasury and vendor payments. Any manual send from a hot wallet with a long, busy history is exposed in the same way.

Busy wallets are a real share of the targets. In a sample of 3,000 lookalikes we flagged on Base, 4.1% were aimed at wallets with more than 1,000 real counterparties, the profile of a payout, exchange or payment wallet.

Controls that work

Never take a destination from transaction history. Keep recipients in a managed address book or allowlist, added through a separate, verified channel.
Verify address changes out of band. When a payee or customer gives a new address, confirm it over a channel you already trust before the first payout.
Compare full addresses in tooling, not truncated ones. Show the complete address on approval screens.
Hold first payouts to new addresses for review, and add friction where a new address looks like an existing one.
Screen every destination against a list of known poisoning lookalikes before a payout or withdrawal settles. A hit is almost never a mistake by the attacker: it is an address that was planted next to a real counterparty.

Screening with Verdix

Verdix reads every token transfer on Base and flags a lookalike in the block its bait lands, before anyone pays it. In a random sample, at least 93% of flags were confirmed as poisoning on-chain (95% confidence), and none of 757 sampled lookalikes was on GoPlus's or ScamSniffer's public lists. Three real payments to lookalikes were made after we had already flagged them, between 32 hours and 6.5 days earlier: a screen against the feed would have caught them.

You can take the feed as a daily file (a real-time API is available on request), starting with a free sample and a 14-day trial. Details on the business page.

Check a Base address for free → see if it was used as a poisoning lookalike. For businesses → screen payouts, withdrawals and wallet sends against our feed of flagged lookalikes.

Sources

Verdix, “Base address poisoning — October 2026” (counts, method, three payments to flagged lookalikes): https://api.verdixapi.com/report/2026-10
Verdix precision check, October 2026: random sample of 50 flags, and a sample of 3,000 flags scanned for victims with more than 1,000 counterparties (internal; method summary on request)
Tsuchiya, Dong, Soska, Christin, “Blockchain Address Poisoning”, USENIX Security 2025: https://arxiv.org/abs/2501.16681
Verdix live poisoning stats, updated hourly: https://api.verdixapi.com/stats