← Guides

How to avoid address poisoning in MetaMask, Coinbase Wallet and Rabby

Wallet warnings help, but they differ from wallet to wallet. These habits work everywhere; the wallet features below are what each vendor documents itself.

In every wallet

Don't copy from history. Poisoning only works if you pick the recipient from your past transactions. Use an address book entry you checked once, or get the address from the recipient again.
Compare the whole address. Bots match the first and last characters on purpose. Check the middle too.
Treat “first time sending to this address” as a stop sign when you thought you were paying someone you've paid before.
Confirm on a hardware wallet screen if you use one, reading the full address there.
Check a suspicious recipient with our free checker before you send.

Don't rely on the wallet alone. A 2025 study of 53 Ethereum wallets found that only three gave an explicit warning when the user tried to send to a phishing address.

MetaMask

Lookalike warning. MetaMask documents that it compares the destination against your transaction history and shows a blocking warning if it closely resembles an address you used before. It announced this detection on June 17, 2026, together with showing more characters of each address.
New-address warning. It also warns when you send to an address you've never interacted with.
Contacts. MetaMask recommends saving addresses you use often in its address book: open the menu and select Contacts.

Keep MetaMask updated so you have these warnings, and take a blocking warning seriously: cancel, then get the address from the recipient again.

Coinbase Wallet

We couldn't find Coinbase documentation that describes a dedicated address-poisoning warning in Coinbase Wallet, so we don't claim one here. The general habits above apply in full:

Get the recipient's address directly from them (for example by scanning their QR code) instead of from your activity list.
Ignore transfers in your activity you didn't make, including zero amounts and tokens you don't recognise. Don't interact with them.
Compare the full address before you confirm, and reuse a verified address after a test payment.

Rabby

Whitelist. Rabby recommends its Whitelist feature: save the addresses you trust, and don't transfer to addresses that aren't on it.
Read its warnings before you sign. Rabby shows security alerts before you sign a transaction. If it warns about the recipient of a payment you believe is routine, stop and get the address again.

If something looks wrong

Don't send. If you already sent, see what to do next.

Check a Base address for free → see if it was used as a poisoning lookalike. For businesses → screen payouts, withdrawals and wallet sends against our feed of flagged lookalikes.

Sources

MetaMask Support, “Address poisoning scams”: https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/
MetaMask, “Address poisoning detection now live in MetaMask”, June 17, 2026: https://metamask.io/news/address-poisoning-detection
Rabby Wallet on X, security tips thread (February 2023), which recommends the Whitelist feature: https://threadreaderapp.com/thread/1623299526189514753.html
Guan, Li, “Ethereum Crypto Wallets under Address Poisoning: How Usable and Secure Are They?”, 2025: https://arxiv.org/abs/2508.12107
Tsuchiya, Dong, Soska, Christin, “Blockchain Address Poisoning”, USENIX Security 2025: https://arxiv.org/abs/2501.16681