A lookalike row in wallet history can swallow a whole swap deposit. How to avoid address poisoning on a crypto swap deposit: copy the pay-to string only from the live YBEX order screen, then match the full destination on the wallet sign screen, especially the middle characters. Vanity dust is a tiny inbound transfer from an address that copies the start and end of the real one. Do not paste from Recent or Activity.
Summary: Address poisoning plants a lookalike wallet in your history so truncated UIs look familiar. Copy the YBEX deposit address from the live order for this Order ID, not from Recent or Activity. Compare the full string, especially the middle, before you send. If you already paid a lookalike, stop, save the Order ID and TxID, and write only official support.
YBEX is an instant crypto exchange at ybex.io. On the homepage widget you set You send / You receive, both networks, the recipient address, Fixed or Floating, then accept Terms / AML / Privacy and tap Exchange. A standard swap does not need an account. The service is not available to persons located in, resident in, incorporated in, established in, or acting from the EU/EEA.
The deposit address is the pay-to string for this order, tied to that Order ID. Pair guides describe it as one-time or session-bound, so last week’s real deposit is already the wrong order. Clipboard malware that swaps a copied string is a different trap; here the bait sits on-chain in history.
How to copy the YBEX deposit address from the live order screen
Do type ybex.io yourself, then create the order on the YBEX swap widget. Don’t start from a search ad, a DM, or a forwarded support URL. Domain checks: how to verify the official YBEX website. Stay on the order screen after Exchange.
Workflow:
Official ybex.io → create this order → copy depositAddress (and memo if shown) from the live order screen → compare the middle on Send / hardware → hide inbound dust, don’t copy from history → send the exact claimed amount
- Confirm you are not in the EU/EEA, set pair and networks, paste your receive address, accept Terms / AML / Privacy, and tap Exchange.
- Save the Order ID from that screen. It is the receipt number for this swap.
- Copy depositAddress from this live order only. If a memo or destination tag is shown (an extra routing note some coins need), copy that too.
- Copy the exact claimed deposit amount and the network pill. Don’t round.
- Paste into Send, put the two strings side by side, and read the middle, not only the ends.
- If you use a hardware wallet (a device that shows the destination on its own screen), match the same full string there.
- Send only after every check matches. Don’t pull a familiar row from Recent.
- If any character differs, discard it, go back to the open order, and copy again. Don’t send the history string.
Do treat screenshots, chat paste, and explorer fields as untrusted. Don’t reuse a previous YBEX deposit. A new order gets a new pay-to.
How to spot vanity dust and lookalike wallet history
Address poisoning is a copy-paste trap. An attacker crafts a vanity address that matches the first and last characters of an address you already used, then plants it in your history with a zero-value transfer, a fake USDT/USDC token, or a tiny real dust send. Recent truncates long strings, so 0xEdf89…ff7ED can look identical while the middle is different.
Do treat any unsolicited inbound as hostile for copying. Don’t assume dust means the wallet is hacked. Anyone can send to a public address; dust does not move your coins or steal keys. Elliptic separates dusting (watching who you are) from poisoning (theft via a lookalike you paste). Ignore the row. Don’t add that sender to Contacts.
MetaMask help warns when the first four and last four characters match but the middle differs, and tells you not to copy from history, including your own. Blockaid flagged 65.4 million poisoning transactions between January 2025 and February 2026. Those warnings are not a reason to copy from Recent.
| Check | Live YBEX order screen | Wallet Recent / Activity |
|---|---|---|
| Source | depositAddress for this Order ID | Unsolicited inbound or old real send |
| Ends of the string | Match the order you just created | Often match; that is the bait |
| Middle characters | The string you must copy | Often different; truncated UI hides it |
| Memo / tag | Shown on this order if the route needs it | Usually missing or from another payment |
| What to do | Copy, compare full string, then send | Hide or ignore. Never paste as pay-to |
Verdict: Copy from the live order. History is read-only. Matching ends are not a match.
How to compare the full deposit string, especially the middle
Do read a chunk from the middle of the order screen against the Send field. Don’t stop at the first and last four, six, or eight characters. Poisoning kits grind those ends so a truncated UI looks identical.
Put the order tab and the wallet tab on one screen if you can. Check groups of four or five characters through the middle. If the wallet shortens the destination, expand it. On a hardware wallet, the device screen is the last honest view. Do confirm the destination there. Don’t tap through because the computer already “looks right.”
Do make sure the network matches the order pill. A T-prefix TRC-20 (Tron) string is not an ERC-20 (Ethereum, 0x) string. A 0x prefix is not always Ethereum; it can also be BNB Chain. Wrong network is a separate loss from poisoning, and both are final on-chain.
How to keep inbound dust out of your address book
Do add Contacts only from a source you opened on purpose: this YBEX order screen, or your own wallet Receive screen. Don’t promote an inbound sender because it looked like last time.
If the wallet can hide zero-value transfers, turn that on. Fake tokens can still show as USDT or USDC with a 0 amount; don’t treat the ticker as proof. Don’t approve, don’t claim, don’t follow a link in the token name. A previous successful YBEX deposit is still the wrong copy source for a new order.
Pre-send checklist before you pay the crypto swap deposit
Do run this list in one look. Don’t send if any line fails. If a memo or destination tag appears, use the destination tag and memo checklist.
- Source is the open YBEX order for this Order ID, not Recent, Activity, explorer, chat, or a screenshot.
- Full deposit string matches, including a middle chunk, on the order, the Send field, and the hardware screen.
- Network matches the order pill.
- Memo or destination tag is present if the order showed one.
- Amount equals the claimed deposit. Don’t round and don’t add a top-up.
- Hardware confirm is done, or you accepted that a software-only Send is weaker.
A small same-route test does not skip this list. Create a new large order and copy that deposit from the new screen. Don’t reuse the test deposit address, and don’t copy the test counterparty from history. Blockaid documented a December 2025 case: a $50 test, then 49,999,950 USDT to a poisoned address 26 minutes later. Test steps: how to run a test swap before a large transfer.
How to stop if you already sent to a lookalike
Stop. Don’t send a second payment to complete the order. Don’t pay an unlock invoice from chat. Don’t reuse the same history row.
Save the Order ID, the send-side TxID (the explorer hash), and screenshots of the order and Send screens. Write official YBEX support or [email protected] only if the order was created on ybex.io. Ignore anyone who DMs you first. The public channel is t.me/ybex_io; swaps are not completed in messengers.
On-chain sends are final. The YBEX Terms of Use (2.5, 6.2, 6.3) put user mistakes on the user. Terms 6.5 describe processing in 30 minutes to 72 hours. That is not a promise to recover coins you sent to a lookalike.
Next time, type ybex.io, create a fresh order on the YBEX widget, copy depositAddress from that screen, compare the middle, then send the exact amount. Don’t save a previous deposit as a shortcut.
Frequently asked questions
Is address poisoning the same as a clipboard clipper?
No. Poisoning plants a lookalike in on-chain history so you copy the wrong row. A clipper is malware that swaps the clipboard after a good copy. Defense here: copy from the live YBEX order, not Recent. This page is not a malware-removal guide.
Why are matching first and last characters not enough?
Lookalikes are ground to match truncated UIs. Check a middle chunk against the order screen. MetaMask warns when the first four and last four match while the middle differs.
What if I already copied an address from wallet history?
Discard it. Go back to the open YBEX order and copy depositAddress again. Compare the full string before Send. Do not send the history string.
Does unexpected dust mean my wallet is hacked?
No. Anyone can send to a public address. Dust does not move your funds. Do not interact and do not copy that sender.
Does a successful test swap protect the large send?
Only the small route. Create a new large order and copy that deposit from the new screen. Attackers have poisoned history minutes after a test (Blockaid $50M case).
Can YBEX reverse a send to a lookalike?
On-chain sends are final. Terms 2.5, 6.2, and 6.3 leave user errors with the user. Do not expect recovery. Stop, save IDs, and write official support if the order was on ybex.io.
Should I save a previous YBEX deposit address for next time?
No. Pair guides describe a one-time or session deposit address. A new order gets a new depositAddress. An old real deposit is the wrong order.
Disclaimer: The material in this article is not financial or investment advice. Everything stated here reflects the author's personal view and should not be treated as a recommendation to trade or invest. We make no warranties regarding the accuracy, reliability or completeness of the information presented. Cryptocurrency markets are highly volatile and can move unpredictably. Before committing any funds, every investor, trader or crypto user should study several independent sources and check the regulations that apply in their own jurisdiction.