BTC Logo

BTCVanity

Custom Address Generator

Buy us a coffee

Our free tools run entirely on donations. Your support pays for the servers and GPU power that make every generation possible. If we helped you today, a small donation helps keep this service free for everyone.

ETH · Ethereum network
0xcf5777b71c31146bd396cece6d3128e42d0ad9f7

Thank you for keeping us running! ❤️

Security

Bitcoin Address Poisoning: Look-Alike Addresses

An attacker can create a different address sharing a familiar prefix or suffix. Those matching characters are not evidence of ownership.

By Updated 2 min readRead as Markdown

A familiar fragment can mislead. Imitation: A look-alike can share visible characters; Truncation: Short displays hide most of the destination; Confirmation: Verify every character against a trusted record.
A familiar fragment can mislead. Imitation: A look-alike can share visible characters; Truncation: Short displays hide most of the destination; Confirmation: Verify every character against a trusted record.Open full-size diagram (SVG)Download diagram (PNG)About these visual guides
Short answer: An attacker can create a different address sharing a familiar prefix or suffix. Those matching characters are not evidence of ownership.

Why checking only the ends can fail

Vanity search demonstrates that a recognizable fragment is not unique evidence of a person or organization. A look-alike destination can share the characters your wallet happens to display while differing in the hidden middle.

A checksum checks the integrity of an encoded string. It does not know which recipient you intended. A malicious destination can be fully valid.

Compare against an independent reference

When preparing a payment, use receiving instructions obtained through a channel you already trust. Expand shortened addresses and compare the complete destination. If a copied value changes, or an invoice unexpectedly changes networks, resolve that discrepancy before proceeding.

  • Do not choose a recipient solely from a recent-activity list.
  • Inspect the address actually shown in the final wallet confirmation.
  • Treat an unexpected change to established payment instructions as a reason to reconfirm them.

Publish enough information to avoid ambiguity

Display the network and complete address alongside a QR code. A memorable prefix can aid recognition, but your payment instructions should not tell users to validate only that fragment.

Read how names and vanity addresses differ if you are designing a receiving page. If an explorer result is confusing, use the address and transaction ID guide to identify the type of record you are viewing.

Explore the related mechanism

Sources and editorial method

The technical references below support the concepts discussed in this article. Examples and comparison worksheets are explanatory, not measured service benchmarks.

Read how these articles are prepared.

Read next