Address Poisoning
A scam that plants a look-alike address in your transaction history so you copy it by mistake when you next pay.
An attacker generates an address whose first and last characters match one you regularly send to, which is computationally cheap for a handful of characters, then sends you a zero-value or dust transaction from it so the address appears in your wallet's history. Because wallets and explorers abbreviate addresses to their beginning and end, the fake is visually identical at the point where most people check. The victim later copies the address from history rather than from the original source, and the funds go to the attacker irreversibly. The defenses are procedural: never copy an address from transaction history, keep verified addresses in an address book, verify the full string or a checksum rather than the ends, and send a small test transfer before a large one.
Na prática
Some variants use a token contract that emits a transfer event without any real value moving, so the poisoned entry appears in the history without the attacker spending anything meaningful.
O equívoco comum
That checking the first and last few characters is sufficient verification, when those are exactly the characters the attacker reproduced.