Why allowlists stop address poisoning

One holder lost $12.4M to a single poisoned-address transaction in January 2026. The attack doesn't need a bug — it needs you to glance at the first and last four characters of an address and assume the rest matches.

Address poisoning works by sending a near-zero transaction from a look-alike address to your wallet, so it shows up in your recent activity. Later, when you go to send funds and copy an address from that history, there's a decent chance you grab the poisoned one instead of the real recipient.

Why this keeps working

It works because most wallets treat every address the same way: as 42 characters you're trusted to verify yourself, every single time, under no particular pressure to slow down. That trust is exactly what an allowlist removes from the equation.

What an allowlist actually changes

Only addresses you've explicitly approved can receive funds from your account. A look-alike address that isn't on your list gets rejected by the account itself — on-chain, before the transaction goes anywhere. The attacker still gets to send you their poisoned dust. They just never get anything back.