Stop Address Poisoning: A Free, Local-Only Tool to Catch Look-Alike Crypto Wallets

If you've been in crypto for a while, you've probably seen it: a transaction in your history where the from or to address looks almost identical to a wallet you actually use — same first 6 characters, same last 4, but a couple of bytes in the middle swapped. That's address poisoning, and it's designed for the one moment you're careless: when you copy an address from your history instead of from your address book.

I built a small, single-file tool to defend against exactly this. No backend, no upload, no tracking — it runs entirely in your browser.

What it does

Paste in:

1. Your trusted addresses (your own wallets / frequent counterparts), and
2. The recent addresses from your history (copy-paste from a block explorer or wallet).

It flags any history address that is a near-twin of one of your trusted addresses — differing by only 1–2 characters but sharing a long common prefix or suffix. That's the signature of a poisoning attempt.

Live tool: https://flapjax-audit.apps.workbuddy.host/antipoison.html

Four built-in checks

1. Poison detection — Hamming distance + prefix/suffix similarity against your trusted set. Flags "high-risk" (≤2 char diff) vs "suspicious" (3–4 diff).
2. Batch common-feature + on-chain behavior analysis — paste a whole batch of suspicious addresses and it computes their shared prefix/suffix, per-position character diversity, and the most-likely imitation target. It then queries BSC RPC for each address (transaction count, native balance, token balance) to classify them as fresh/puppet (≤3 txns, typical of bulk-generated poisoners) or active, and whether they've already dumped the token.
3. Blacklist matching — ships with a real-world poisoner distribution address from a batch we investigated (202 transfers of 1–3 USDC in 30 minutes). Add your own.
4. Trusted-address persistence — your trusted set and blacklist are saved to localStorage, so they survive a refresh.

Everything stays on your machine. The only network calls are the optional on-chain lookups you trigger yourself.

Why I built it

We recently audited a token treasury (FLAPJAX on BSC) and, while pulling transfer logs, ran straight into a live address-poisoning campaign hitting the same ecosystem. The poisoner had generated dozens of addresses that mimicked real recipients. The "batch common-feature" view in the tool is literally what we used to characterize that campaign.

If you want to see the audit methodology, it's published alongside the tool: https://flapjax-audit.apps.workbuddy.host/?sharecode=ANRLDLKIW3

How to use it safely

The #1 rule the tool enforces: never copy an address from your transaction history. Always paste from your password manager / address book / a verified file. The checker is a second line of defense, not a replacement for that habit.

Self-host

It's a single HTML file. Download it, open it in any browser, done. No build step, no dependencies. Open source, MIT.

---

If this tool saved you from one wrong transfer, tips are welcome (Solana):

• General tip: HCqPmPJM3NVtS6YrmVaTZYnuP8XZ2PFgQZKT94VK1LkS
• Code / open-source tip (GitHub Sponsors, Show HN, etc.): A2PPKc6uSJkeGXzcf5YXLqoTzonssK89pPfeF4nyC5qz