One of the most common crypto scams today does not hack anything. It just copies you.

It is called address poisoning. A scammer creates a wallet address that starts and ends with the same characters as someone you already pay, for example:

Real: 0x1234567890abcdef1234567890abcdef1234abcd Fake: 0x1234ffffffffffffffffffffffffffffffffabcd

Most wallets show addresses shortened, like 0x1234…abcd. Both look identical. People copy the wrong one from their history and lose money.

I'm building Tazvera, a simple open source wallet in Hindi + English for first-time crypto users in India. For our users, this kind of scam is a real risk, so we built Tazvera Shield: a few simple checks that run on the confirm screen, before any coins leave the wallet.

What Shield checks

  1. Look-alike address: same first 4 and last 4 characters as a contact or a past address, but a different middle → red warning, and the Send button stays locked until the user ticks "I checked every letter".
  2. First-time address: never sent here before → a calm yellow note, no extra taps.
  3. Burn and token contract addresses: sending to 0x000… or to a token's own contract → red warning (coins are usually lost forever).
  4. Smart contract address: we ask the network for the code at that address (eth_getCode). If there is code, we show a gentle note.
  5. Known address: a green "all clear", so normal payments stay fast.

The core check is tiny 

function lookAlike(to, known) { to = to.toLowerCase(); return known.find(k => k.address !== to && k.address.slice(2, 6) === to.slice(2, 6) && // same start k.address.slice(-4) === to.slice(-4) // same end ); }

known is built only from data already on the user's phone: their address book and the addresses they sent to before. Nothing is uploaded.

Design choices that mattered

  • Warn only when it matters. Our first version showed too many warnings and checkboxes. Users started tapping "OK" without reading. Now a normal send is just: Send → PIN. Red appears only for real danger.
  • Show the full address, highlighted. On the confirm screen we show the whole address with the first 6 and last 4 characters in bold green, so people actually compare it.
  • Block, don't just inform. For red cases, the Send button is disabled until the user confirms they checked.

Try it / help us

Tazvera is a volunteer project by a solo founder, so I can't pay, but ideas, reviews and pull requests are very welcome. What other scam patterns should a wallet warn about? Tell me in the comments 🙏