It's a very normal habit to check the first and last 4 characters of a wallet address to make sure it's the right one when you're sending funds. I used to do this myself. Address poisoning attackers aim to exploit this habit by: – Generating a lookalike address that matches the one you recently transacted with – Transferring a very small amount (dust transfer) so their address sits in your txn history The attack assumes that next time you need to send to that address, you'll copy it from either your wallet's transaction history, or possibly Etherscan. Best practice here is to label the addresses you send to often in your wallet. Recognizing a name is much harder to spoof than recognizing 4 characters at each end of a hex string. @etherscan also has a built-in way to flag suspicious addresses before you copy them. You cannot undo a transfer, so this 5-minute read is definitely worth your time ↓