Address poisoning (or "address spoofing") is a relatively new method of tricking crypto wallet users into sending funds to scammers.
How It Usually Works
- A malicious actor scans a victim's transaction history to identify addresses frequently used for outbound ERC20 transfers
- They generate one or more addresses looking very similar to the target, typically sharing the same (or nearly the same) last 4 characters
- They generate a transaction that appears in the wallet transaction history, mimicking a legitimate transaction
In the Safe Multisig UI, a scammer might send an equal amount of USDC (fake USDC with the same symbol) using an address with the same first 3 and last 4 characters.
What typically happens next is the wallet user copies the scammer's address, thinking it's legitimate, and sends real funds to it.
How Safe Multisig Protects Users
We detect imitation transactions using the criteria described above, plus the fact that Safe Multisig itself didn't execute the transaction.
These transactions are marked as malicious, and users receive a warning when copying the address.
Nested Safe Poisoning
A more sophisticated variant of address poisoning specifically targets Safe Multisig multisig users through the "nested Safes" feature.
How It Works
Anyone can create a new Safe and add any existing Safe as one of its owners. When they do this, the newly created Safe automatically appears as a "nested Safe" in the parent Safe's UI—even though the parent Safe's signers never created or authorized it.
Attackers exploit this by:
- Identifying high-value Safe multisigs and their signers
- Bulk-creating malicious Safes (one observed campaign created ~200 in a single transaction) with lookalike addresses closely matching the victim's legitimate nested Safes
- Adding the victim's Safe as an owner on these malicious Safes, causing them to surface in the victim's UI as seemingly legitimate nested Safes
- Pre-signing transactions on the malicious Safe so any funds sent to it are immediately drained to an attacker-controlled wallet
With a similar-looking address and zero balance (like any newly created Safe), users can easily mistake it for their own and send funds directly.
Why This Is Particularly Dangerous
Unlike standard address poisoning, which relies on copying an address from transaction history, nested Safe poisoning plants the malicious address close to the original Parent Safe. This makes it significantly harder to detect, especially for teams that frequently create and manage sub-accounts.
How Safe Multisig Has Responded
Following this discovery, the Safe team took immediate steps:
- Flagging all identified malicious addresses via security partners
- Building backend filtering to detect lookalike addresses (matching prefix/suffix patterns)
- Developing improved curation UX requiring users to explicitly select and verify their nested Safes rather than having them auto-populated
How to Protect Yourself
Always verify the full address of any nested Safe before sending funds, not just the first and last few characters. Cross-reference the address with what was shown on-chain at creation time, and treat any unfamiliar nested Safe appearing in your UI with suspicion, even if it looks like one you just created.